Active defense-oriented cloud service honey point generation method and system

Abstract

The invention provides an active defense-oriented cloud service honey point generation method and system, and relates to the technical field of network security, and the method comprises the steps: generating a cloud asset map based on an initial honey point and a honey point deception scene obtained through simulation of real asset equipment; when the authenticated user drags and changes the cloud function, obtaining an updated cloud asset graph, exporting a configuration file based on the updated cloud asset graph, and extracting from a preset honey point strategy template library based on the configuration file to obtain a template sample; arranging the template samples to obtain a plurality of honey point deployment templates according with the corresponding cloud environment and attack path; and generating a plurality of IaC source code files based on the IaC template, and calling a preset Terraform based on the IaC source code files to generate a plurality of honey points. According to the invention, the completely real cloud service infrastructure is used as the honey point, and the honey point is adjusted in real time by using the design thought of the input parameter, the output parameter and the intermediate check point in the honey point in cooperation with the monitoring and alarm of the cloud service, so that the security of the network system is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a cloud service honeypot generation method and system for active defense. Background Art

[0002] Network deception defense is an active security strategy that confuses attackers by placing false information in the network, thereby protecting real assets. This technology aims to guide attackers to interact with false resources, thereby capturing and analyzing their behavior and providing key threat intelligence to the defender. However, with the emergence of worms, botnets, and advanced persistent threats, attack methods have become more and more complex, and traditional passive defense mechanisms have gradually shown their shortcomings. These mechanisms rely on the attacker's new technology to update the defense rules, making the defense always passive and easy to bypass, reducing the security of the network system. Therefore, it is urgent to provide a solution to improve the above problems. Summary of the invention

[0003] The purpose of the present invention is to provide a cloud service honeypot generation method and system for active defense, so as to improve the problem of low security of the network system caused by the low defense capability of the defender when facing more complex attack methods of the attacker.

[0004] In a first aspect, the present invention provides a cloud service honey spot generation method for active defense, which adopts the following technical solution:

[0005] Generate a cloud asset map based on initial honey spots and honey spot deception scenarios obtained by simulating real asset devices, wherein the cloud asset map has multiple cloud facilities, including but not limited to honey spots, storage buckets, and cloud functions;

[0006] When the authenticated user drags and changes the cloud function, an updated cloud asset graph is obtained, a configuration file is exported based on the updated cloud asset graph, and a template sample is extracted from a preset honey spot strategy template library based on the configuration file;

[0007] Arrange the template samples to obtain multiple honey spot deployment templates that meet the corresponding cloud environment and attack path, and the honey spot deployment template is an IaC template available for Terraform;

[0008] A plurality of IaC source code files are generated based on the IaC template, and a preset Terraform is called based on the IaC source code files to generate a plurality of honey spots.

[0009] The beneficial effects of a cloud service honey spot generation method for active defense provided by the present invention are: first, using real cloud facilities as honey spots, by taking real cloud facilities as honey spots, all cloud facilities are included in the scope of deception defense, thereby improving the comprehensiveness and flexibility of protection; second, using infrastructure as code (IaC) to build honey spots, and using Terraform to build honey spots, so that the deployment of honey spots is more flexible; third, establishing a dynamic feedback mechanism for honey spots, using the input and output parameter design mechanism of honey spots to associate the honey spots with each other, dynamically adjusting the generation and destruction of honey spots according to alarm feedback processing, reducing resource consumption, while maintaining a high level of confusion; fourth, supporting a multi-cloud service migration mechanism through a module and template mechanism, and being able to use the same code to quickly build on different cloud service provision platforms.

[0010] Optionally, the honey spot includes a pre-trigger condition and a consequence prediction strategy, each pre-trigger condition corresponds to a unique honey spot transformation strategy, and when an attacker triggers the pre-trigger condition, the corresponding honey spot service is transformed.

[0011] Optionally, when an attacker attacks the honey spot along the attack path, when the number of alarm triggering is less than or equal to the trigger threshold, the template sample is eliminated, and an updated template sample is reselected from the preset honey spot strategy template library, and an updated honey spot is obtained based on the updated template sample.

[0012] Optionally, the cloud asset map corresponds to the currently running honey spot. During the entire operation of the honey spot, the assets in the cloud asset map can be modified at any time, and these modifications will be applied to the cloud facility through Terraform's IaC source code changes.

[0013] In a second aspect, the present invention further provides a cloud service honey spot generation system for active defense, comprising:

[0014] A cloud asset map module is used to store and manage multiple cloud facilities, and generate corresponding configuration files according to cloud facilities dragged and changed by authenticated users, wherein each of the cloud facilities corresponds to a cloud service asset, and multiple cloud service assets are combined into a cloud asset map;

[0015] The honey spot and policy module is used to store multiple honey spot policy templates according to the relational database. Multiple different cloud facilities have a honey spot policy template with the same policy.

[0016] A control terminal module, used for automatically extracting template samples that meet the corresponding cloud environment and attack path from the honey spot and policy module according to the configuration file, and generating IaC source code based on the template samples and the configuration file;

[0017] A code calling module, used to call Terraform according to the IaC source code to update the types and quantities of cloud facilities to obtain an updated cloud asset map;

[0018] An orchestration component module, used to extract and obtain sampling samples from the honey spot strategy template, and to orchestrate the sampling samples to obtain template samples for a specified cloud facility;

[0019] The alarm feedback module is used to process events generated by cloud facilities in the cloud asset map to generate corresponding alarm events, and push the alarm events to the control terminal module.

[0020] Optionally, the alarm feedback module specifically includes:

[0021] The decoy module is used to combine storage buckets and cloud functions to generate decoy resources;

[0022] A real-time log module, used for guiding the attacker to attack the cloud facilities in the cloud asset map according to the bait resources to generate multiple attack logs, combining the multiple attack logs to obtain log report events, and sending the log report events to a storage bucket for storage;

[0023] An audit module, used to trigger a corresponding alarm mechanism according to a preset alarm condition, and send the log report event stored in the storage bucket to the event bus component based on the alarm mechanism;

[0024] The event bus module is used to orchestrate the log report event to obtain an alarm event, and send the alarm time to the control terminal to perform a Terraform call to update the cloud facilities in the cloud asset map.

[0025] For the beneficial effects of the second aspect, reference may be made to the description of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 It is a flow chart of a cloud service honey spot generation method for active defense provided by the present invention;

[0027] Figure 2 It is a flow chart of the cloud asset map, control terminal, orchestration component, and policy library module provided by the present invention;

[0028] Figure 3 It is a module diagram of the alarm feedback component provided by the present invention. DETAILED DESCRIPTION

[0029] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be understood by people with general skills in the field to which the present invention belongs. "Including" and similar words used in this article mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0030] First, the present invention explains a series of nouns:

[0031] Infrastructure as code (IaC): refers to the ability to configure computing infrastructure using code instead of manual processes and settings. Infrastructure as code can define the desired state of the infrastructure without including all the steps to obtain that state. Infrastructure as code describes the system architecture and its working principles. It controls virtualized resources by treating configuration files as source code files. As long as the infrastructure resources are available, the same IaC source code can be used to deploy the same environment to different systems in other locations.

[0032] Terraform: is an open source Infrastructure as Code (IaC) tool that allows developers to use high-level configuration languages ​​to describe and provision data center infrastructure. In this way, developers can manage and orchestrate various services and resources on cloud environments, virtualization platforms, or physical hardware.

[0033] In some embodiments, see Figure 1 , indicating a cloud service honey spot generation method for active defense provided by the present invention, comprising the following steps:

[0034] S1. Generate a cloud asset map based on initial honey spots and honey spot deception scenarios obtained by simulating real asset devices, wherein the cloud asset map has multiple cloud facilities, including but not limited to honey spots, storage buckets, and cloud functions;

[0035] S2. When the authenticated user drags and changes the cloud function, an updated cloud asset graph is obtained, a configuration file is exported based on the updated cloud asset graph, and a template sample is extracted from a preset honey spot strategy template library based on the configuration file;

[0036] S3. Arrange the template samples to obtain multiple honey spot deployment templates that meet the corresponding cloud environment and attack path, where the honey spot deployment template is an IaC template available for Terraform;

[0037] S4. Generate multiple IaC source code files based on the IaC template, and call a preset Terraform based on the IaC source code files to generate multiple honey spots.

[0038] In some embodiments, see Figure 2 When an authenticated user drags and changes a cloud function from the cloud asset graph, the cloud asset graph exports a configuration file and sends it to the control terminal. The control terminal extracts the honeyspot and policy template corresponding to the configuration file from the honeyspot and policy template library based on the configuration file, and inputs them into the orchestration component for orchestration processing and sends them to the control terminal. The control terminal outputs the IaC code.

[0039] In some embodiments, when executing step S1, the honey spot includes a pre-trigger condition and a consequence prediction strategy, each pre-trigger condition corresponds to a unique honey spot transformation strategy, and when an attacker triggers the pre-trigger condition, the corresponding honey spot service is transformed.

[0040] Furthermore, when executing step S1, the cloud asset map corresponds to the currently running honey spot. During the entire operation of the honey spot, the assets in the cloud asset map can be modified at any time, and these modifications will be applied to the cloud facility through Terraform's IaC source code changes.

[0041] In some embodiments, when executing step S3, when the attacker attacks the honey spot along the attack path, when the number of alarm triggering is less than or equal to the trigger threshold, the template sample is eliminated, and the updated template sample is reselected from the preset honey spot strategy template library, and the updated honey spot is obtained based on the updated template sample.

[0042] In other embodiments, the present invention further provides a cloud service honey spot generation system for active defense, including:

[0043] The cloud asset map module M1 is used to store and manage multiple cloud facilities, and generate corresponding configuration files according to the cloud facilities dragged and changed by the authenticated user, wherein each of the cloud facilities corresponds to a cloud service asset, and multiple cloud service assets are combined into a cloud asset map;

[0044] Specifically, the cloud asset map is a graphical representation of the cloud service assets that can be listed based on the cloud service provider credentials provided by the user. Users can manage cloud service assets in a graphical interface. This part serves the deployment of honey spots. Users can select a series of related honey spots and corresponding deception scenarios from the honey spot and policy template library for existing assets and drag them to the cloud asset map; users can also only drag one or several honey spots, set their input and output parameters and intermediate checkpoints as required, and thus form their own trapping scheme. When users set honey spots or policies to the asset map, these contents will be synchronized to the orchestration component. The orchestration component generates the correct IaC source code according to the specified template in the honey spot and policy template library.

[0045] The honey spot and policy module M2 is used to store multiple honey spot policy templates according to a relational database, and multiple different cloud facilities have a honey spot policy template with the same policy;

[0046] Specifically, the honey spot and policy template library mainly stores honey spots and policy templates written by professional security personnel. In fact, for different cloud service providers, they each have a template for the same policy. The template library is implemented using a relational database and exposes APIs for orchestration components and control terminals to access. When a honey spot service is created or modified, the orchestration component searches for the corresponding available templates from the template library and combines multiple different partial templates to form the IaC source code.

[0047] A control terminal module M3, used for automatically extracting template samples that meet the corresponding cloud environment and attack path from the honey spot and policy module M2 according to the configuration file, and generating IaC source code based on the template samples and the configuration file;

[0048] Specifically, the control terminal module M3 is mainly responsible for receiving alarm feedback and building and scheduling cloud environment honey spots. When the user modifies the asset map or reaches the trigger condition to change the honey spot, the IaC source code processed by the orchestration component will be passed to the control terminal. At this time, the control terminal will call Terraform based on the new IaC source code to update the facilities in the cloud environment. When the alarm arrives through the control terminal's API, the control terminal will determine the attacker's behavior based on the IaC template and traverse along the set checkpoints. When the attacker's path moves along the designed way, the control terminal records the attacker's behavior.

[0049] Furthermore, when the effect of a deception scenario is limited and the attacker cannot trigger an alarm along the designed path, the control terminal module M3 will adjust the honey spots with fewer triggers. Select better strategies and honey spot templates from the honey spot and policy module M2, and then redeploy some or all of the honey spots to build a new deception scenario that is more in line with the actual business and has a higher "sweetness". In particular, when the honey spots are determined to be no longer needed according to the policy, they will be removed from the current cloud environment within a period of time after the last interaction, thereby saving costs.

[0050] A code calling module M4 is used to call Terraform according to the IaC source code to update the types and quantities of cloud facilities and obtain an updated cloud asset map;

[0051] The orchestration component module M5 is used to extract a sample from the honey spot strategy template and orchestrate the sample to obtain a template sample for a specified cloud facility;

[0052] Specifically, the orchestration component module M5 is mainly responsible for using the IaC source code to perform actual cloud facility deployment. Its API receives formatted description data from the control terminal, which specifies the policies to be adopted and the user-defined honey spot configuration. Then, according to the formatted configuration, the corresponding policies and honey spot templates for the specified cloud service are found from the honey spot and policy template library. Then a new Terraform source code file is generated, and the corresponding Terraform module is referenced from the honey spot and policy template library for orchestration.

[0053] Furthermore, the orchestration component module M5 will place decoy resources in storage buckets and cloud functions according to the needs of the template, thereby connecting the input and output parameters between the honey spots and completely constructing the entire deception scenario. Before the entire set of facilities is deleted, this set of source code will be saved on disk and assigned an ID to facilitate index reuse. After the entire set of facilities is orchestrated, all configuration parameters will be passed back to the control terminal module M3, which will eventually call Terraform to deploy the cloud service honey spots.

[0054] When modifying an existing honey spot, the orchestration component module M5 receives formatted description data from the control terminal module M3, which specifies the resource ID and the modified part to be modified. The orchestration component module M5 first parses the data, then finds the corresponding IaC source code, modifies the relevant parts, and the control terminal module M3 finally calls Terraform to execute the changes and complete the honey spot deployment.

[0055] The alarm feedback module M6 is used to process the events generated by the cloud facilities in the cloud asset map to generate corresponding alarm events, and push the alarm events to the control terminal module M3.

[0056] Specifically, taking AWS (Amazon Web Service, Amazon Technology Cloud Service) as an example, the alarm feedback module M6 relies on four major components: cloud audit service, cloud monitoring service, simple storage service, and simple notification service. At this time, all events generated in the cloud facility will pass through the cloud audit service, so it is only necessary to configure according to the input parameters, output parameters, and intermediate checkpoints of the relevant honey points, filter out some events that need to be processed, and then send events to the designated log group of the cloud monitoring service. In the cloud monitoring service, filter the designated log group, select the events that need to push alarms, and call the designated simple notification service to push them to the control terminal module M3.

[0057] In fact, for a single honey spot in a deception scenario, its generation runs through the cloud asset map module M1, the control terminal module M3, the orchestration component module M5, the alarm feedback module M6, and the honey spot and policy module M2. First, the user customizes or specifies the honey spot configuration by the terminal, and then the orchestration component module M5 takes the required template from the template library and assembles it into an IaC template that can be used by Terraform. The bait resources required in the cloud environment are also generated here, such as the IAM credentials or storage bucket credentials that need to be leaked. The control terminal module M3 only needs to call Terraform to complete the deployment, and the honey spot will exist in the cloud environment.

[0058] For details, see Figure 3 , the alarm feedback module M6 specifically includes:

[0059] The decoy module M61 is used to combine storage buckets and cloud functions to generate decoy resources;

[0060] A real-time log module M62, configured to guide an attacker to attack cloud facilities in a cloud asset map according to the bait resources to generate multiple attack logs, combine the multiple attack logs to obtain a log report event, and send the log report event to a storage bucket for storage;

[0061] Audit module M63, used to trigger a corresponding alarm mechanism according to a preset alarm condition, and send the log report event stored in the storage bucket to the event bus component based on the alarm mechanism;

[0062] The event bus module M64 is used to orchestrate the log report event to obtain an alarm event, and send the alarm time to the control terminal to perform a Terraform call to update the cloud facilities in the cloud asset map.

Claims

1. A cloud service honeypot generation method for active defense, characterized in that: The following steps are involved: Generate a cloud asset map based on initial honey spots and honey spot deception scenarios obtained by simulating real asset devices, wherein the cloud asset map has multiple cloud facilities, including but not limited to honey spots, storage buckets, and cloud functions; When the authenticated user drags and changes the cloud function, an updated cloud asset graph is obtained, a configuration file is exported based on the updated cloud asset graph, and a template sample is extracted from a preset honey spot strategy template library based on the configuration file; Arrange the template samples to obtain multiple honey spot deployment templates that meet the corresponding cloud environment and attack path, and the honey spot deployment template is an IaC template available for Terraform; A plurality of IaC source code files are generated based on the IaC template, and a preset Terraform is called based on the IaC source code files to generate a plurality of honey spots.

2. The method for generating cloud service honey spots for active defense according to claim 1, characterized in that: The honey spot includes a pre-triggering condition and a consequence prediction strategy. Each pre-triggering condition corresponds to a unique honey spot transformation strategy. When an attacker triggers the pre-triggering condition, the corresponding honey spot service is transformed.

3. The method for generating cloud service honey spots for active defense according to claim 1, characterized in that: When the attacker attacks the honey spot along the attack path, when the number of alarm triggering is less than or equal to the trigger threshold, the template sample is eliminated, and the updated template sample is reselected from the preset honey spot strategy template library, and the updated honey spot is obtained based on the updated template sample.

4. The method for generating cloud service honey spots for active defense according to claim 1, characterized in that: The cloud asset map corresponds to the currently running honey spot. During the entire operation of the honey spot, the assets in the cloud asset map can be modified at any time. These modifications will be applied to the cloud facility through Terraform's IaC source code changes.

5. A cloud service honeypot generation system for active defense, characterized in that: include: A cloud asset map module is used to store and manage multiple cloud facilities, and generate corresponding configuration files according to cloud facilities dragged and changed by authenticated users, wherein each of the cloud facilities corresponds to a cloud service asset, and multiple cloud service assets are combined into a cloud asset map; The honey spot and policy module is used to store multiple honey spot policy templates according to the relational database. Multiple different cloud facilities have a honey spot policy template with the same policy. A control terminal module, used for automatically extracting template samples that meet the corresponding cloud environment and attack path from the honey spot and policy module according to the configuration file, and generating IaC source code based on the template samples and the configuration file; A code calling module, used to call Terraform according to the IaC source code to update the types and quantities of cloud facilities to obtain an updated cloud asset map; An orchestration component module, used to extract and obtain sampling samples from the honey spot strategy template, and to orchestrate the sampling samples to obtain template samples for a specified cloud facility; The alarm feedback module is used to process events generated by cloud facilities in the cloud asset map to generate corresponding alarm events, and push the alarm events to the control terminal module.

6. The cloud service honeypot generation system for active defense according to claim 5, characterized in that: The alarm feedback module specifically includes: The decoy module is used to combine storage buckets and cloud functions to generate decoy resources; A real-time log module, used for guiding the attacker to attack the cloud facilities in the cloud asset map according to the bait resources to generate multiple attack logs, combining the multiple attack logs to obtain log report events, and sending the log report events to a storage bucket for storage; An audit module, used to trigger a corresponding alarm mechanism according to a preset alarm condition, and send the log report event stored in the storage bucket to the event bus component based on the alarm mechanism; The event bus module is used to orchestrate the log report event to obtain an alarm event, and send the alarm time to the control terminal to perform a Terraform call to update the cloud facilities in the cloud asset map.

Images