Active attack trapping method and system for advanced persistent threats

Abstract

The invention discloses an active attack trapping method and system for advanced persistent threats, and belongs to the technical field of safety monitoring. The method comprises the following steps: generating a trapping target to enable an inducer to initiate an attack on a protected object, a trapping server or / and a trapping intranet area based on an advanced persistent threat; wherein real service software and high-simulation data are deployed on the trapping server, and the trapping intranet area is a simulation network containing services, applications and data of a conventional intranet; identifying a malicious code file corresponding to the advanced persistent threat based on the flow generated in the attack process; activity records generated when an attacker attacks a protected object, a trapping server or an intranet system are obtained, and the attack state of advanced continuous threats is perceived in combination with attack conditions. According to the method, an attack surface and high-value assets can be actively exposed to an attacker, and the attacker is induced to explore and attack, so that attack means can be obtained, malicious codes can be captured, the attention of the attacker can be attracted, and a real information system can be protected.

Description

Technical Field

[0001] The invention belongs to the technical field of security monitoring, and relates to an active trapping method and system for attacks oriented to advanced persistent threats. Background Art

[0002] Advanced persistent threat (APT) attacks are becoming more and more rampant, and attacks are common. APT attacks have seriously threatened the network and information security of various key areas and industries. It is necessary to carry out research on APT threat detection and prevention technologies to improve APT detection and prevention capabilities.

[0003] Existing APT detection and prevention technologies mainly include: fingerprint-based attack detection technology, passive trapping detection technology and intelligent detection technology.

[0004] (1) Fingerprint-based attack detection technology

[0005] Currently, this type of technology is the mainstream technology for network security detection. It detects attack behaviors based on previously extracted and deployed attack fingerprints. If the attack traffic is encrypted, or a new attack method is used, or the attack fingerprint is not pre-extracted, it cannot be detected. The advantage of this type of detection technology is that the detection method is simple and direct, and it can accurately detect attack behaviors in real time. It is also easy to deploy and is generally deployed at the network exit or to receive traffic split by switching equipment. Firewalls, IDS, and IPS all use this mechanism.

[0006] (2) Passive trapping detection technology

[0007] The idea behind this type of technology is to deploy highly simulated entrapped assets, such as data, services, and applications, within the system, waiting for attackers to detect, discover, and attack. Since these assets are not used by normal users, access to these assets can be considered an attack or potential attack. Passive entrapment technology does not rely on fingerprints, so it can discover new attack methods and attackers. The difficulty lies in how to achieve high simulation to deceive attackers into thinking that it is a real high-value target and attack. In addition, entrapment needs to be deployed in a systematic manner to achieve effective detection results. In addition, the current entrapment methods are passive strategies, and they will not work if the attacker does not discover the entrapped assets.

[0008] (3) Intelligent detection technology

[0009] The idea is to analyze the difference between attacks and normal business, extract features, build classifiers, and analyze traffic or various business logs in real time to discover attack behaviors. In addition, some research work also uses deep learning for detection. Compared with fingerprint detection technology, this type of technology has better detection capabilities, but it relies on comprehensive data to extract features and build classifiers. However, the workload of obtaining and analyzing data is extremely large. Security vendors rarely use this method, and this method has not been widely used in practical applications.

[0010] However, fingerprint-based attack detection technology can only detect known attacks, passive trapping detection technology can only be effective after the attacker detects it, and the acquisition and analysis cost of the data required for intelligent detection technology training is extremely high and has poor interpretability. Therefore, there is an urgent need for a method to overcome the above problems. Summary of the invention

[0011] In response to the APT attacks currently faced by important information systems, the present invention proposes an active attack trapping method and system for advanced persistent threats. The present invention also does not rely on existing features and attack fingerprints, has accurate detection, and does not generate false positives. Compared with the passive APT attack trapping scheme, the present invention can actively expose the attack surface and high-value assets to the attacker, induce the attacker to conduct exploration and attack, thereby obtaining the means of attack and capturing malicious code. In addition, the attacker's attack on the trapping system also serves to attract the attacker's attention and protect the real information system.

[0012] To achieve the above-mentioned object of the invention, the technical solution of the present invention includes the following contents.

[0013] An active trapping method for attacks against advanced persistent threats, the method comprising:

[0014] Generate a trap target to induce an attacker to launch an attack on a protected object, a trap server or / and a trap intranet area based on an advanced persistent threat; wherein the IP address of the trap target is in the same subnet as the real information system, the protected object includes services and content similar to the real information system, the trap server deploys real service software and highly simulated data, and the trap intranet area is a simulated network containing services, applications and data of a conventional intranet;

[0015] Based on the traffic generated during the attack process, identify the malicious code files corresponding to the advanced persistent threat;

[0016] Obtain activity records generated when attackers attack protected objects, entrapped servers, or intranet systems, and combine the attack situation to perceive the attack status of the advanced persistent threat.

[0017] Furthermore, the generation of the trap target to induce the attacker to launch an attack on the protected object, the trap server and / or the trap intranet area based on the advanced persistent threat includes:

[0018] Generate a trap target, the trap target includes: a trap domain name, the similarity between the trap domain name and the normal domain name is greater than a threshold, and the real information system cannot be accessed based on the trap domain name;

[0019] The trap target is exposed to the attacker, so that the attacker can use the trap server as a springboard to attack the trap intranet area after the attacker has compromised the trap server corresponding to the trap target based on the advanced persistent threat.

[0020] Furthermore, the generation of the trap target to induce the attacker to launch an attack on the protected object, the trap server and / or the trap intranet area based on the advanced persistent threat includes:

[0021] Generate a trap target, the trap target comprising: a trap server's response to a detection data packet whose destination address is not a real information system;

[0022] The trap target is exposed to the attacker, so that the attacker can use the trap server as a springboard to attack the trap intranet area after the attacker has compromised the trap server corresponding to the trap target based on the advanced persistent threat.

[0023] Further, generating a response of the trapping server to a detection data packet whose destination address is not a real information system includes:

[0024] Intercepting an attacker's scan of a real information system, wherein the scan is used to detect the IP address and open ports of the real information system;

[0025] For the detection data packets whose destination addresses are not real information systems in the scan, the destination addresses are modified to the addresses of the trapping servers, so as to inform the attackers that the servers they want to attack are online and have open ports and operating system information;

[0026] Change the address of the decoy server to the reply IP address to respond to further attacks from the attacker.

[0027] Furthermore, the generation of the trap target to induce the attacker to launch an attack on the protected object, the trap server and / or the trap intranet area based on the advanced persistent threat includes:

[0028] Generate a trap target, the trap target includes: a real information system response with trap information embedded, the trap information is a trap server link and a content link corresponding to the real information system;

[0029] The trap target is exposed to the attacker, so that the attacker can use the trap server as a springboard to attack the protected object and the trap intranet area after the attacker has compromised the trap server corresponding to the trap target based on the advanced persistent threat.

[0030] Furthermore, the generation of the trap target to induce the attacker to launch an attack on the protected object, the trap server and / or the trap intranet area based on the advanced persistent threat includes:

[0031] Generate a trap target, the trap target includes: a protection object pulled up based on the scan of the compromised host;

[0032] The response data generated by the pulled-up protection object is sent to the compromised host to inform the compromised host of the existence of the attackable target.

[0033] Furthermore, the identifying of the malicious code file corresponding to the advanced persistent threat based on the traffic generated during the attack process includes:

[0034] Extract suspicious files based on the traffic generated during the attack process; wherein the suspicious files include: files obtained by the agent of the entrapped target and files extracted based on the split traffic of the SDN switch;

[0035] The suspicious file is subjected to malicious code identification to obtain a malicious code file corresponding to the advanced persistent threat.

[0036] Furthermore, after performing malicious code identification on the suspicious file to obtain the malicious code file corresponding to the advanced persistent threat, the method further includes:

[0037] The malicious code file is attempted to be run in a sandbox containing multiple types of operating systems and operating system versions to obtain an analysis report of the malicious code file.

[0038] Furthermore, the acquisition of activity records generated when the attacker attacks the protected object, the entrapped server or the intranet system, and the perception of the attack status of the advanced persistent threat in combination with the attack situation, includes:

[0039] Generate an attack log based on the activity records generated when the attacker attacks the protected object, the entrapped server or the intranet system; wherein the attack log includes: system operation log and service software log;

[0040] According to the attack log and the attack situation, the attack status of the advanced persistent threat is perceived; wherein the attack status includes: attack target, attack process and attack means.

[0041] An active attack trapping system for advanced persistent threats, the system comprising:

[0042] A protected object trapping area for providing protected objects, wherein the protected objects include services and contents similar to real information systems;

[0043] The trap DMZ area is used to provide a trap server that deploys real service software and high-simulation data;

[0044] A trapping intranet area, for providing a trapping intranet, wherein the trapping intranet is a simulated network including services, applications and data of a conventional intranet;

[0045] The data analysis and execution area is used to generate entrapment targets to induce attackers to launch attacks on protected objects, entrapment servers and / or entrapment intranet areas based on advanced persistent threats; identify malicious code files corresponding to the advanced persistent threats based on the traffic generated during the attack process; obtain activity records generated by the attacker when attacking the protected object, entrapment server or intranet system, and perceive the attack status of the advanced persistent threat in combination with the attack situation; wherein the IP address of the entrapment target is in the same subnet as the real information system.

[0046] Compared with the prior art, the present invention has at least the following technical advantages:

[0047] (1) Logical isolation between the decoy system and the real information system.

[0048] The trapping system provides an attack target for the attacker, and the trapping system can be used as a springboard to attack the next attack target. In order to ensure that the real information system is not attacked, the logical isolation between the trapping system and the real information system should be done well. Data initiated from the real information system to the trapping system can be forwarded, but data packets initiated from the trapping system and destined for the real information system will not be forwarded.

[0049] (2) IP settings of the trapping system and the real information system.

[0050] In order to ensure that the attacker can find the trapped target in the trap system, the IP address of the trapped target in the trap DMZ area is in the same subnet as the real information system. When the attacker performs a subnet scan on the real information system, the existence of the trapped target in the trap DMZ area can be detected.

[0051] (3) Rapid dynamic deployment of trapping services

[0052] In order to achieve the purpose of effective entrapment, the service that the attacker detects needs to be able to be deployed in seconds. This can be achieved through containerized deployment. By pre-making a container containing a specific service, it can be quickly started for entrapment when needed.

[0053] The specific operation method is to pre-configure a batch of containers with commonly used services deployed. The selection of these services is based on the latest popular attack methods provided by threat intelligence, the services frequently attacked by attackers, and the commonly used services of this information system. The trapping system analyzes the scanning behavior, identifies or infers the services that the attacker wants to attack, and quickly starts the container with the corresponding service deployed, waiting for the attacker to detect and attack.

[0054] For example, if an attacker probes a fixed port of several IPs, the trapping system infers that the attacker is trying to detect whether a service is deployed, and if so, launches an attack. The trapping system quickly pulls up the container that deploys the service corresponding to the port, and deploys a suitable network address, waiting for the attacker to detect and provide an attack target.

[0055] Compared with static trapping, dynamic deployment of trapping services significantly saves computing and storage resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 Schematic diagram of the deployment method of the trapping system of the present invention.

[0057] Figure 2 Architecture diagram of the trapping system of the present invention.

[0058] Figure 3 A flow chart of the trapping scheme of the present invention.

[0059] Figure 4 Flowchart of trapping scheme 2 of the present invention.

[0060] Figure 5 Flow chart of trapping scheme three of the present invention.

[0061] Figure 6 Flowchart of trapping scheme 4 of the present invention.

[0062] Figure 7 A diagram of the protection object trapping area structure of the present invention.

[0063] Figure 8 Module architecture diagram of the traffic analysis and scheduling part of the present invention.

[0064] Fig. 9 Architecture diagram of the data analysis and execution portion of the trapping system of the present invention. DETAILED DESCRIPTION

[0065] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0066] The active attack trapping system of the present invention is interconnected with the SDN switch, and traps the attacker through four active trapping strategies, namely, attack trapping technology based on domain name, asset exposure technology that actively responds during scanning, trapping technology when key targets are attacked, and pulling up services that the attacker is interested in during the attacker's intranet scanning. Please refer to the following content for specific instructions.

[0067] 1. Deployment of the trapping system

[0068] Trapping system deployment methods Figure 1 As shown. The trapping system is interconnected with the SDN switch, and the logical relationship with the real information system is parallel. In addition, a traffic analysis and scheduling system is required to analyze the traffic split by the SDN switch in real time, and schedule part of the traffic passing through the SDN switch through the SDN switch to assist in completing the attack trapping. For details, see the trapping strategy and the introduction of each part.

[0069] 2. Trapping system architecture

[0070] Figure 2 This is the architecture diagram of the trapping system, which includes 4 core parts:

[0071] √ Protect the object trapping area, including the following functions: providing services and content that are highly similar to the real information system, receiving

[0072] Respond to and forward all kinds of requests and data packets sent.

[0073] √ DMZ zone. Deploy the devices and services in the regular DMZ zone, such as Web servers, OA servers, FTP servers, etc.

[0074] Servers, mail servers, etc., and deployed real service software and high-simulation data, such as high-simulation data with real data desensitized. Accept various requests and data packets, respond and forward them.

[0075] √ Trapping the intranet. Deploy a regular intranet service, application, and data. For example, data storage servers and high-fidelity data

[0076] According to reports, PCs deployed in the intranet, intranet office desktop cloud systems, etc. are used to provide attackers with scenarios for lateral penetration of the intranet.

[0077] √ Trapping system data analysis and execution area, including the following functions: (1) Actively respond to certain sniffing scanning behaviors, reveal

[0078] (1) provide the attacker with assets and attack surfaces, and induce the attacker to launch an attack; (2) analyze the traffic of the trapping system and the internal traffic of the trapping system in real time; (3) extract various types of files contained in the traffic online; (4) accept the activity records of the attacker on each server and host submitted by the other three core parts of the trapping system, and control the data flow within the trapping system according to the attack situation.

[0079] To summarize, the general functions of these four parts can be seen in Table 1.

[0080]

[0081] Table 1

[0082] 3. Trapping Strategy

[0083] The present invention includes 4 trapping strategies, as follows:

[0084] Trapping strategy 1: Actively expose the entrapped site by registering a domain name.

[0085] The trapping strategy pre-prepares a series of domain names, the resolution addresses of these domain names are the trapping servers in the trapping system. Attackers find the trapping servers through these domain names and launch attacks. Security protection personnel can obtain a series of attack traffic and malicious codes to achieve the purpose of trapping.

[0086] Trapping strategy - core steps of the whole process reference Figure 3 Under this trapping strategy, the corresponding attack steps are as follows:

[0087] Step 1: The protection personnel register a series of decoy domain names. These decoy domain names are not released to the public for normal users to use. Normal users will not access the information system through these domain names, but attackers can obtain them through domain name query or guessing the subdomain names. For example, if the normal domain names are www.website.com, email.website.com, oa.website.com, then www.website.net, emails.website.com, oasystem.website.com and other domain names can be used as decoy domain names;

[0088] Step 2: The attacker obtains the domain names www.website.net, emails.website.com, and oasystem.website.com.

[0089] Step 3: The attacker attacks the server corresponding to www.website.net;

[0090] Step 4: After the attacker compromises the server corresponding to www.website.net, he uses it as a springboard to conduct lateral penetration and attack the trapped intranet area.

[0091] Trapping strategy 2: Expose the entrapped site by actively responding to scans.

[0092] The trapping strategy detects scanning behavior in real time and responds proactively, informing the attacker that some detected IP addresses are online and host some services, which can be further detected and attacked. It is worth noting that a trapping system can provide trapping services to multiple information systems. In this case, the trapping system can be deployed in the cloud or SaaS. When scanning an IP address that does not exist in the real information system, the attacker can be informed that the IP address exists, and the subsequent scans and attacks on the IP address will be forwarded to the trapping system for processing, and the processing results will be returned to the attacker.

[0093] Trapping Strategy 2 Core Steps of the Whole Process Reference Figure 4 Under this trapping strategy, the corresponding attack steps are as follows:

[0094] Step 1: The attacker scans the target system network segment to detect which IP addresses and open ports exist. The SDN switch forwards the detection data packets whose destination addresses are not the real information system to the trapping area. The trapping area modifies the destination addresses of some detection packets to the trapping server addresses in the trapping area DMZ and submits the data packets, which are responded by the trapping servers of the trapping system.

[0095] Step 2: The server in the DMZ area of ​​the trapping system receives the scanning data packet and informs the attacker that it is online, and according to the scanning type, it can further inform the open port information or operating system information, etc. The trapping system data analysis and execution area in the trapping area is responsible for modifying the IP address of the trapping DMZ server to the IP address of the response, that is, the attacker detects whether address A exists, the trapping system responds, and all subsequent attacks on address A are transferred to the corresponding trapping server for response.

[0096] Step 3: The attacker performs service, vulnerability scans, and attacks on the servers actively exposed in the trapping system to obtain the required information and compromise the target system.

[0097] Step 4: The attacker conducts lateral penetration and attacks the trapped intranet area.

[0098] Trapping strategy three: implant high-value attack targets during the attack and deliver them to the attacker.

[0099] This strategy is suitable for attackers who conduct deep scanning and attack on certain contents of the target and find vulnerabilities to attack. The essence of the strategy is to provide a highly simulated attack surface to the attacker, who can launch a series of attacks such as attacking, stealing data, and improving system permissions. However, since the attack surface is deployed in the trapping system, the attacker does not get the desired result.

[0100] Trapping Strategy 3 Core Steps of the Whole Process Reference Figure 5 Under this trapping strategy, the corresponding attack steps are as follows:

[0101] Step 1: The attacker crawls, scans, and detects attack points on the protected site to find vulnerabilities;

[0102] Step 2: The real information system’s response to the attacker is not directly returned to the attacker through the SDN switch, but is sent to the trapping system, which receives and processes it in the trapping system’s data analysis and execution area.

[0103] Step 3: The data analysis and execution area of ​​the trapping system implants trapping information into the content. The implanted trapping information is the server link and content link corresponding to the protection site in the trapping area;

[0104] Step 4: The attacker attacks the decoy site based on the decoy server connection and content link.

[0105] Trapping strategy 4: The attacker launches the service of interest when scanning the intranet.

[0106] This strategy is suitable for scenarios where an attacker has controlled an intranet host and is conducting lateral penetration. According to their attack plan, the attacker attempts to scan the intranet, looking for new attack targets and detecting whether certain services are enabled. This strategy detects the scanning behavior and senses the services that the attacker expects to discover. If the service does not exist in the trapping system, the service is quickly suspended, providing the attacker with an attack target and achieving the purpose of trapping.

[0107] Trapping Strategy 4 Core Steps of the Whole Process Reference Figure 6 Under this trapping strategy, the corresponding attack steps are as follows:

[0108] Step 1: The compromised host scans and discovers systems and services that can be used for attacks. The traffic monitoring and scheduling module of the real information system analyzes the traffic, discovers the scanning behavior and intercepts some scanning data packets.

[0109] Step 2: The traffic monitoring and scheduling module notifies the trapping system of the scanning behavior and sends the scanned IP, service and scanning data packet to the data analysis and execution area in the trapping system;

[0110] Step 3: The trapping system quickly pulls up new systems and services to build trapping targets, and notifies the traffic monitoring and scheduling module of the real information system that it is ready, and sends the scan data packet of the trapped host to the pulled up system. The response data is also sent to the traffic monitoring and scheduling part;

[0111] Step 4: The traffic monitoring and scheduling module of the real information system forwards the scan response data packet to the compromised host, informing it of the existence of an attackable target;

[0112] Step 5: The compromised host launches an attack on the trapped target.

[0113] 4. Other modules

[0114] 4.1 Protected Object Trapping Area

[0115] The structure of the protected area trapping area is as follows Figure 7 As shown, it includes three core parts: Web gateway, Web trapping information implantation, and several simulation sites corresponding to real systems.

[0116] The Web gateway receives the forwarded request, determines whether it should be submitted to a certain trapping server, and gives it to it for response, and accepts the simulated response result and forwards it to the SDN switch (the main switch inside the trapping system). In addition, the Web gateway also receives specific page information (the response of the real information system to the scan), and forwards it to the Web trapping information implantation module, and waits for the Web trapping information implantation part to process it before forwarding the new page information (to the SDN switch in the trapping system).

[0117] The Web trapping information implantation module receives the page content forwarded by the Web gateway, implants the link used for trapping, and returns it to the Web gateway. A trapping link corresponds to the real content of the simulation site (a highly simulated site of the real information system). If the subsequent trapping link is accessed by the attacker, the submitted request will be sent to the simulation site, and the simulation site can process the response and return the normal result.

[0118] There is a one-to-one relationship between the simulation site and the real information system to be protected. Each information system to be protected has a corresponding simulation site, which is specifically used to respond to certain attack requests. The simulation site and page style are consistent with the real business site, and the same Web service software system, website building software and Web framework can be used. In addition, the content is similar, and the content published by the simulation site should also be the content frequently published by the real business site. In order to provide an attack surface, some pages should have vulnerabilities, such as SQL injection, XSS, OS injection, etc. To this end, some query pages or login pages can be provided for attackers to attack. In addition, there is a file upload function and a long file transfer vulnerability; directory traversal attack conditions are provided, and attackers can obtain Web directories.

[0119] 4.2 Traffic Analysis and Scheduling

[0120] The architecture diagram of the traffic analysis and scheduling module is as follows: Figure 8 As shown in the figure, this part contains two core functions, one is scanning detection, and the other is traffic scheduling. They are introduced as follows:

[0121] Scan detection can detect scanning behaviors when real information systems are scanned, including IP scanning, port scanning, service scanning, application layer scanning, etc.

[0122] The traffic scheduling module mainly performs three aspects of scheduling: first, forwarding scanning, forwarding IP scanning that is not used by the real information system to the trapping system for processing, and providing the attacker with IP online information; second, forwarding attack requests to the server or host in the trapping system to the trapping system; third, after receiving the response results of the real information system server to the attack and application layer scanning, it is not forwarded directly to the attacker, but forwarded to the trapping system, and the trapping system implants the trapping link information. After receiving the processing results of the trapping system, it is returned to the attacker.

[0123] 4.3 Trapping system data analysis and execution

[0124] The data analysis and execution part of the trapping system consists of Fig. 9 As shown in the figure, it includes 4 modules: attack status perception, traffic scheduling, traffic collection and file acquisition, and file acceptance module. The functions of these four parts are introduced as follows:

[0125] √ The trapping resource management module is responsible for temporarily pulling up trapping resources, involving a series of operations such as container selection, service opening, firewall configuration, SDN switch configuration, etc., and ultimately providing a real service for the attacker to provide him with an attack target. In addition, it is necessary to deploy an agent to monitor the operating status of the operating system and services. After completing the trapping task, recycle the service and container.

[0126] √ The attack status perception module receives various logs of the entrapped targets sent by the agents deployed on each entrapped target, including system operation logs, service software logs, such as Apache access logs, database operation logs, etc. Through these logs, the attack target, attack process and attack means can be perceived.

[0127] √ The traffic scheduling module changes the SDN switch forwarding rules through the SDN controller according to the attacker's attack intention.

[0128] Attack request forwarding and response satisfy the attacker's attack intention.

[0129] √ The function of the traffic collection and file acquisition module is to collect the traffic split by the SDN switch in real time and extract the file from the traffic.

[0130] The malicious sample identification module is used to identify malicious code, and the high-simulation sandbox module is used to try to run and identify malicious code files.

[0131] √ The file receiving module is responsible for receiving suspicious files sent from the agent on the trap target. This module is related to the traffic collection

[0132] Cooperating with the file acquisition module, most files can be obtained through the agent, but some malicious samples adopt a fileless attack mode and the agent cannot obtain the samples. The traffic collection and file acquisition module can extract such samples from the traffic.

[0133] √The malicious sample identification module integrates multiple malicious code detection software to match and identify malicious code sample files.

[0134] √ The high-simulation sandbox module contains sandboxes of multiple types of operating systems and operating system versions, providing execution loops for suspicious samples.

[0135] environment, and can automatically give analysis reports.

[0136] The above implementation is only used to illustrate the technical solution of the present invention rather than to limit it. Ordinary technicians in this field can modify or replace the technical solution of the present invention with equivalents without departing from the scope of the present invention. The protection scope of the present invention shall be based on the claims.

Claims

1. An active trapping method for advanced persistent threat attacks, characterized in that: The method comprises: Generate a trap target to induce an attacker to launch an attack on a protected object, a trap server or / and a trap intranet area based on an advanced persistent threat; wherein the IP address of the trap target is in the same subnet as the real information system, the protected object includes services and content similar to the real information system, the trap server deploys real service software and highly simulated data, and the trap intranet area is a simulated network containing services, applications and data of a conventional intranet; Based on the traffic generated during the attack process, identify the malicious code files corresponding to the advanced persistent threat; Obtain activity records generated when attackers attack protected objects, entrapped servers, or intranet systems, and combine the attack situation to perceive the attack status of the advanced persistent threat.

2. The method according to claim 1, characterized in that The generating of the trap target to induce the attacker to launch an attack on the protected object, the trap server and / or the trap intranet area based on the advanced persistent threat includes: Generate a trap target, the trap target includes: a trap domain name, the similarity between the trap domain name and the normal domain name is greater than a threshold, and the real information system cannot be accessed based on the trap domain name; The trap target is exposed to the attacker, so that the attacker can use the trap server as a springboard to attack the trap intranet area after compromising the trap server corresponding to the trap target based on the advanced persistent threat.

3. The method according to claim 1, characterized in that The generating of the trap target to induce the attacker to launch an attack on the protected object, the trap server and / or the trap intranet area based on the advanced persistent threat includes: Generate a trap target, the trap target comprising: a trap server's response to a detection data packet whose destination address is not a real information system; The trap target is exposed to the attacker, so that the attacker can use the trap server as a springboard to attack the trap intranet area after compromising the trap server corresponding to the trap target based on the advanced persistent threat.

4. The method according to claim 3, characterized in that Generating a response of the trapping server to a detection data packet whose destination address is not a real information system, comprising: Intercepting an attacker's scan of a real information system, wherein the scan is used to detect the IP address and open ports of the real information system; For the detection data packets whose destination addresses are not real information systems in the scan, the destination addresses are modified to the addresses of the trapping servers, so as to inform the attackers that the servers they want to attack are online and have open ports and operating system information; Change the address of the decoy server to the reply IP address to respond to further attacks from the attacker.

5. The method according to claim 1, characterized in that The generating of the trap target to induce the attacker to launch an attack on the protected object, the trap server and / or the trap intranet area based on the advanced persistent threat includes: Generate a trap target, the trap target includes: a real information system response with trap information embedded, the trap information is a trap server link and a content link corresponding to the real information system; The trap target is exposed to the attacker, so that the attacker can use the trap server as a springboard to attack the protected object and the trap intranet area after the attacker has compromised the trap server corresponding to the trap target based on the advanced persistent threat.

6. The method according to claim 1, characterized in that The generating of the trap target to induce the attacker to launch an attack on the protected object, the trap server and / or the trap intranet area based on the advanced persistent threat includes: Generate a trap target, the trap target comprising: a protection object pulled up based on the scan of the compromised host; The response data generated by the pulled-up protection object is sent to the compromised host to inform the compromised host of the existence of the attackable target.

7. The method according to claim 1, characterized in that The method of identifying the malicious code file corresponding to the advanced persistent threat based on the traffic generated during the attack process includes: Extract suspicious files based on the traffic generated during the attack process; wherein the suspicious files include: files obtained by the agent of the entrapped target and files extracted based on the split traffic of the SDN switch; The suspicious file is subjected to malicious code identification to obtain a malicious code file corresponding to the advanced persistent threat.

8. The method according to claim 7, characterized in that After performing malicious code identification on the suspicious file to obtain the malicious code file corresponding to the advanced persistent threat, the method further includes: The malicious code file is attempted to be run in a sandbox containing multiple types of operating systems and operating system versions to obtain an analysis report of the malicious code file.

9. The method according to claim 1, characterized in that: The acquisition of activity records generated when an attacker attacks a protected object, a entrapped server, or an intranet system, and the perception of the attack status of the advanced persistent threat in combination with the attack situation, includes: Generate an attack log based on the activity records generated when the attacker attacks the protected object, the entrapped server or the intranet system; wherein the attack log includes: system operation log and service software log; According to the attack log and the attack situation, the attack status of the advanced persistent threat is perceived; wherein the attack status includes: attack target, attack process and attack means.

10. An active trapping system for advanced persistent threats, characterized in that: The system comprises: A protected object trapping area for providing protected objects, wherein the protected objects include services and contents similar to real information systems; The trap DMZ area is used to provide a trap server that deploys real service software and high-simulation data; A trapping intranet area, for providing a trapping intranet area, wherein the trapping intranet area is a simulated network including services, applications and data of a conventional intranet; The analysis and execution area is used to generate entrapment targets to induce attackers to launch attacks on protected objects, entrapment servers and / or entrapment intranet areas based on advanced persistent threats; based on the traffic generated during the attack process, the malicious code files corresponding to the advanced persistent threats are identified; the activity records generated when the attacker attacks the protected objects, entrapment servers or intranet systems are obtained, and the attack status of the advanced persistent threats is perceived in combination with the attack situation; wherein the IP address of the entrapment target is in the same subnet as the real information system.

Images