Honeypot drainage method and device, target machine, storage medium and program product

Abstract

The embodiment of the invention discloses a honeypot drainage method and device, a target machine, a storage medium and a program product. The method is applied to host security, the host security is deployed on a target machine, a honeypot probe is integrated on the host security, a target port in the target machine is associated with the honeypot probe, and the target port is in an idle state before being associated with the honeypot probe, and the method comprises the following steps: detecting a traffic access condition on the target port; and under the condition that the first access traffic on the target port is detected, introducing the first access traffic into the target honeypot through the honeypot probe for the target honeypot mapped by the target port. According to the technical scheme provided by the embodiment of the invention, the honeypot probe is integrated on the host security, so that the idle ports on the target machine can be automatically identified by utilizing the host security, and the idle ports are all associated to the honeypot probe for honeypot drainage, and the maximization of honeypot drainage is realized.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of network security technology, and in particular to a honeypot drainage method, device, target machine, storage medium and program product. Background Art

[0002] With the continuous advancement of network technology, there are more and more network attacks on the Internet. In response to this, in order to ensure network security, honeypots are deployed on machines, and related technologies that use honeypots for diversion have emerged.

[0003] In the process of implementing the present invention, the inventors found that the prior art has the following technical problems: the access traffic introduced into the honeypot is limited, that is, it is impossible to maximize the honeypot drainage. Summary of the invention

[0004] The embodiments of the present invention provide a honeypot drainage method, device, target machine, storage medium and program product to maximize the honeypot drainage.

[0005] According to one aspect of the present invention, a honeypot drainage method is provided. The method is applied to host security. The host security is deployed on a target machine. A honeypot probe is integrated on the host security. A target port in the target machine is associated with the honeypot probe. Before the target port is associated with the honeypot probe, it is in an idle state. The method may include:

[0006] Detect traffic access on the target port;

[0007] When the first access traffic is detected on the target port, the first access traffic is introduced into the target honeypot mapped to the target port through a honeypot probe.

[0008] According to another aspect of the present invention, a honeypot drainage device is provided. The device can be configured in a host security, the host security is deployed on a target machine, a honeypot probe is integrated on the host security, a target port in the target machine is associated with the honeypot probe, and the target port is in an idle state before being associated with the honeypot probe. The device may include:

[0009] A flow first detection module is used to detect the flow access situation on the target port;

[0010] The honeypot diversion module is used to guide the first access traffic into the honeypot mapped by the honeypot probe through the honeypot probe when the first access traffic on the target port is detected.

[0011] According to another aspect of the present invention, a target machine is provided, on which host security is deployed, a honeypot probe is integrated in the host security, a target port in the target machine is associated with the honeypot probe, and the target port is in an idle state before being associated with the honeypot probe, the host security includes a computer program, and the target machine includes:

[0012] at least one processor; and

[0013] a memory communicatively connected to at least one processor; wherein,

[0014] The memory stores a computer program that can be executed by at least one processor. The computer program is executed by at least one processor so that the at least one processor implements the honeypot drainage method provided by any embodiment of the present invention when executing the computer program.

[0015] According to another aspect of the present invention, a computer-readable storage medium is provided, on which computer instructions are stored, and the computer instructions are used to enable a processor to implement the honeypot drainage method provided by any embodiment of the present invention when executed.

[0016] According to another aspect of the present invention, a computer program product is provided, on which a computer program is stored. When the computer program is executed by a processor, the honeypot drainage method provided by any embodiment of the present invention is implemented.

[0017] The honeypot drainage method described in the embodiment of the present invention is applied to host security, which is deployed on the target machine. The host security is integrated with a honeypot probe. The target port in the target machine is associated with the honeypot probe. The target port is in an idle state before being associated with the honeypot probe. The method detects the traffic access on the target port, and when the first access traffic on the target port is detected, the first access traffic can be introduced into the target honeypot mapped by the target port through the honeypot probe to complete the honeypot drainage. The above technical solution integrates the honeypot probe on the host security, so that the host security can automatically identify the idle ports on the target machine and associate these idle ports with the honeypot probe. This ability performs honeypot drainage, thereby maximizing the honeypot drainage.

[0018] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0020] Figure 1 is a schematic diagram of optional examples of various honeypot drainage methods provided according to an embodiment of the present invention;

[0021] Figure 2 A flow chart of a honeypot drainage method provided according to an embodiment of the present invention;

[0022] Figure 3 is a flow chart of another honeypot drainage method provided according to an embodiment of the present invention;

[0023] Figure 4 is a flow chart of another honeypot drainage method provided according to an embodiment of the present invention;

[0024] Figure 5 is a structural block diagram of a honeypot drainage device provided according to an embodiment of the present invention;

[0025] Figure 6 It is a schematic diagram of the structure of a target machine for implementing the honeypot drainage method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. The situations of "target", "original", etc. are similar and will not be repeated here. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] It should be noted that the collection, collection, updating, analysis, processing, use, transmission, storage and other aspects of user personal information involved in the technical solution of the present invention are in compliance with the provisions of relevant laws and regulations, are used for legitimate purposes, and do not violate public order and good morals. Necessary measures are taken for user personal information to prevent illegal access to user personal information data and maintain the security of user personal information and network security.

[0029] Before introducing the embodiment of the present invention, the above-mentioned related technology of using honeypot for drainage is exemplified to better understand the honeypot drainage method described in the embodiment of the present invention.

[0030] For example, the related technology reserves machines in the business network to deploy honeypot probes, and introduces attack traffic into the honeynet through the honeypot probes. However, there are at least two problems: First, more machines need to be reserved to deploy more honeypot probes, but this will obviously lead to a waste of resources and it is difficult to achieve coverage of a large number of honeypot probes; second, only one honeypot probe service is deployed on the machine, which is only used to map one or more Web applications or services that appear to be normal businesses but have obvious vulnerabilities, such as big data services, databases, or web content management systems (CMS). There is no identification associated with other normal businesses, which makes it easy for attackers to identify that this is a honeypot trap.

[0031] Two technical concepts are explained here: First, the above-mentioned honeypot probe can also be called a honeypot agent. The honeypot agent is a special network service that allows a terminal (usually a client) to establish an indirect connection with another terminal (usually a server) through itself (that is, the network service); Second, the honeypot is a deception technology for attackers, which is used to detect, analyze and trace attack behaviors. It has no business use. All traffic flowing into and out of the honeypot indicates scanning or attack behavior. Therefore, it can better focus on attack traffic and is often used in network security.

[0032] As another example, in order to solve the above two problems, for business machines with normal business deployed in the business network, the relevant technology directly deploys the honeypot probe on the business machine, and associates a port on the business machine with the honeypot probe, so that the attack traffic given to the port is introduced into the honeynet. This will not cause waste of resources and can achieve a large coverage of the honeypot probe; secondly, because the honeypot probe and normal business are deployed on the business machine at the same time, this can effectively confuse the attacker and prevent the honeypot trap from being discovered.

[0033] However, after associating a port with a honeypot probe, this related technology will no longer associate other ports with the honeypot probe, resulting in limited attack traffic introduced into the honeynet, that is, limited attack traffic introduced into the honeypot, and failure to maximize honeypot drainage.

[0034] On this basis, in order to introduce more attack traffic into the honeypot, the embodiment of the present invention takes into account that host security has been deployed on most or even all business machines in the business network, and the host security can automatically identify idle ports on the business machines. Therefore, the embodiment of the present invention integrates the honeypot probe on the host security, so that after the host security identifies the idle port, the idle port is automatically associated with the honeypot probe, thereby associating more interfaces with the honeypot probe, so that more attack traffic can be introduced into the honeypot using more interfaces, thereby maximizing the honeypot diversion.

[0035] For example, see Figure 1, there are 10 business machines deployed in the business network, and host security is deployed on each of the 10 business machines. The host security is used to monitor the accounts, processes and network traffic files of the corresponding business machines (i.e., hosts) to discover and block possible network threats. Honeypot probes are integrated on each host security to improve the coverage of the honeypot probes. Here, taking the host security deployed on business machine A and the honeypot probe integrated on the host security as an example, the host security can automatically identify idle ports (such as 8080 and 7001) on business machine A, and associate each idle port with the honeypot probe, so that the attack traffic given to these idle ports can be introduced into honeypot A, thereby maximizing the diversion of honeypot A.

[0036] Next, this will be elaborated in detail.

[0037] Figure 2 It is a flow chart of a honeypot drainage method provided in an embodiment of the present invention. This embodiment is applicable to the case of honeypot drainage. The method can be executed by the honeypot drainage device provided in an embodiment of the present invention, and the device can be implemented by software and / or hardware. The device can be integrated on a target machine, and the target machine is deployed with host security, and the host security is integrated with a honeypot probe. The target port in the target machine is associated with the honeypot probe, and the target port is in an idle state before being associated with the honeypot probe.

[0038] See also Figure 2 The method of the embodiment of the present invention specifically includes the following steps:

[0039] S110. Detect traffic access status on the target port.

[0040] Among them, the target machine can be a machine deployed with host security. In combination with the application scenarios that may be involved in the embodiments of the present invention, optionally, the machine can be a business machine for providing business services. On this basis, optionally, the business service can be, for example, a big data service, a database, and a Web CMS, etc. This is related to the actual situation and is not specifically limited here.

[0041] The target machine has at least two ports exposed to the outside. Normally, some of the at least two ports are in an occupied state, and such ports can be called occupied ports, and the other part of the ports are in an idle state, and such ports can be called idle ports. As explained above, host security can identify the idle port and associate the idle port with the honeypot probe to divert traffic to the honeypot through the idle port. It can be understood that the port associated with the honeypot probe is no longer in an idle state, but in an occupied state. In order to facilitate the distinction from the occupied port, the port associated with the honeypot probe is referred to as the target port. The number of the target port can be one or more, which is related to the actual situation and is not specifically limited here. It can be seen that the target port is an idle port in an idle state before being associated with the honeypot probe.

[0042] It should be noted that for the real service deployed on the target machine corresponding to the honeypot probe, the target honeypot (i.e. the virtual service corresponding to the real service) represented by the honeypot probe is more vulnerable to attack. Therefore, the probability of attack traffic hitting the target port is greater than the probability of hitting the occupied port occupied by the real service.

[0043] The host security detects the traffic access situation on the target port, which can indicate whether there is access traffic hitting the target port. The access traffic may be abnormal access traffic (i.e., attack traffic) or normal access traffic (i.e., non-attack traffic), which depends on the actual situation and is not limited here. It should be noted that in order to distinguish it from the access traffic hitting the occupied port, the access traffic hitting the target port is referred to as the first access traffic.

[0044] S120. When the first access traffic is detected on the target port, for the target honeypot mapped to the target port, the first access traffic is introduced into the target honeypot through a honeypot probe.

[0045] The target honeypot can be understood as the honeypot proxied by the honeypot probe, that is, the honeypot mapped to the target port associated with the honeypot probe. When the first access traffic on the target port is detected, the host security can introduce the first access traffic into the target honeypot through the honeypot probe, that is, complete the honeypot diversion through port mapping, and avoid the first access traffic, which is likely to be attack traffic, from affecting the target machine.

[0046] On this basis, optionally, the target machine is located in the target network, the target honeypot is located in the honeynet, the honeynet is connected to the target machine, and at least two honeypots are deployed in the honeynet, and the at least two honeypots include the target honeypot. Therefore, after detecting the first access traffic, the host security can determine the target honeypot mapped to the target port from the at least two honeypots, so as to guide the first access traffic into the correct honeypot (i.e., the target honeypot) through the honeypot probe, thereby ensuring the correctness of the honeypot diversion and avoiding the first access traffic, which is likely to be attack traffic, from affecting the target network.

[0047] The honeypot drainage method described in the embodiment of the present invention is applied to host security, which is deployed on the target machine. The host security is integrated with a honeypot probe. The target port in the target machine is associated with the honeypot probe. The target port is in an idle state before being associated with the honeypot probe. The method detects the traffic access on the target port, and when the first access traffic on the target port is detected, the first access traffic can be introduced into the target honeypot mapped by the target port through the honeypot probe to complete the honeypot drainage. The above technical solution integrates the honeypot probe on the host security, so that the host security can automatically identify the idle ports on the target machine and associate these idle ports with the honeypot probe. This ability performs honeypot drainage, thereby maximizing the honeypot drainage.

[0048] Figure 3 It is a flow chart of another honeypot drainage method provided in an embodiment of the present invention. This embodiment is optimized based on the above-mentioned technical solutions. In this embodiment, optionally, the target machine includes at least two ports, and the above-mentioned honeypot drainage method may also include: collecting the occupancy status of at least two ports; when an idle port is identified among at least two ports according to the occupancy status, the idle port is used as the target port and associated with the honeypot probe. Among them, the explanations of the terms that are the same as or corresponding to the above-mentioned embodiments are not repeated here.

[0049] See also Figure 3 The method of this embodiment may specifically include the following steps:

[0050] S210. Collect the occupancy status of at least two ports, and when an idle port is identified among the at least two ports based on the occupancy status, use the idle port as a target port and associate it with the honeypot probe.

[0051] The target machine has at least two ports exposed to the outside, and the host security can automatically collect the occupancy status of each of the at least two ports, and the occupancy status can indicate whether the corresponding port is in an occupied state or an idle state. Furthermore, when the host security determines that there is an idle port among the at least two ports based on the collected occupancy status, the idle port can be used as the target port and associated with the honeypot probe, so that the target port can be used for honeypot drainage later.

[0052] In actual applications, optionally, the occupancy status of at least two ports can be collected based on a preset time interval, that is, the occupancy status can be repeatedly collected. In this way, newly added idle ports can be discovered in time to associate the idle ports with the honeypot probe, thereby increasing the number of target ports that can be used for honeypot drainage. This helps to introduce more first access traffic into the target honeypot, further maximizing the honeypot drainage.

[0053] S220. Detect traffic access status on the target port.

[0054] S230. When the first access traffic is detected on the target port, for the target honeypot mapped to the target port, the first access traffic is introduced into the target honeypot through a honeypot probe.

[0055] The technical solution of the embodiment of the present invention automatically collects the occupancy status of each port through host security, and when an idle port is found, the idle port is associated with the honeypot probe as a target port, thereby realizing automatic identification and association of idle ports and preparing for subsequent honeypot drainage.

[0056] Figure 4 It is a flow chart of another honeypot diversion method provided in an embodiment of the present invention. This embodiment is optimized based on the above-mentioned technical solutions. In this embodiment, optionally, a real service corresponding to the target honeypot is deployed on the target machine, and at least two ports include an occupied port occupied by the real service. The honeypot diversion method also includes: detecting the traffic access status on the occupied port; when the second access traffic on the occupied port is detected, forwarding the second access traffic to the real service. Among them, the explanations of the terms that are the same or corresponding to the above-mentioned embodiments are not repeated here.

[0057] See also Figure 4 The method of this embodiment may specifically include the following steps:

[0058] S310. Collect the occupancy status of at least two ports, and when an idle port is identified among the at least two ports based on the occupancy status, use the idle port as a target port and associate it with the honeypot probe.

[0059] S320. Detect traffic access status on the target port.

[0060] S330. When the first access traffic is detected on the target port, for the target honeypot mapped to the target port, the first access traffic is introduced into the target honeypot through a honeypot probe.

[0061] S340. Detect traffic access on the occupied port, wherein a real service corresponding to the target honeypot is deployed on the target machine, and the occupied port is a port occupied by the real service among at least two ports.

[0062] The target honeypot can be understood as a fake service used to simulate a real service. The real service is a real service deployed on the target machine. The ports occupied by the real service are called occupied ports. The host security detects the traffic access to the occupied ports. It should be noted that in order to distinguish it from the first access traffic, the access traffic hitting the occupied port is called the second access traffic.

[0063] S350. When the second access traffic on the occupied port is detected, forward the second access traffic to the real service.

[0064] When the host security detects the second access traffic on the occupied port, since the occupied port corresponds to the real service, the second access traffic is forwarded to the real service for response.

[0065] For example, Figure 1 As shown, when the access traffic hits 80, 443 or 22, the access traffic is forwarded to the real service for response; similarly, when the access traffic hits 8080 or 7001, the access traffic is introduced into honeypot A through the port mapping function of the honeypot probe.

[0066] The technical solution of the embodiment of the present invention can forward the second access traffic entering the occupied port occupied by the real service to the real service to ensure the effective response of the second access traffic.

[0067] On this basis, optionally, the target honeypot is located in the honeynet, and the real service and the honeypot probe as the honeypot entrance of the target honeypot are located in the target network, so that the network interconnection protocol of the honeypot entrance is the same as the network interconnection protocol of the real service. In other words, the target honeypot and the real service are located in different networks, so that the Internet Protocol (IP) of the two is different, but fortunately the honeypot entrance of the target honeypot (i.e., the honeypot probe) is the same as the IP of the real service, which can better disguise the honeypot, reduce the attacker's awareness of prevention, and thus reduce the probability of being identified as a honeypot trap.

[0068] Figure 5 This is a structural block diagram of a honeypot drainage device provided in an embodiment of the present invention, and the device is used to execute the honeypot drainage method provided in any of the above embodiments. The device and the honeypot drainage method of the above embodiments belong to the same inventive concept. For details not described in detail in the embodiment of the honeypot drainage device, please refer to the embodiment of the above honeypot drainage method. Figure 5 The device can be configured in host security, the host security is deployed on the target machine, the host security is integrated with a honeypot probe, the target port in the target machine is associated with the honeypot probe, and the target port is in an idle state before being associated with the honeypot probe. The device may include: a first flow detection module 410 and a honeypot diversion module 420. Among them,

[0069] The first flow detection module 410 is used to detect the flow access situation on the target port;

[0070] The honeypot diversion module 420 is used to, when detecting the first access traffic on the target port, guide the first access traffic into the honeypot mapped by the honeypot probe through the honeypot probe.

[0071] Optionally, the target machine includes at least two ports, and the honeypot drainage device may further include:

[0072] An occupancy status collection module, used to collect occupancy status of at least two ports;

[0073] The association module is used to associate the idle port with the honeypot probe as a target port when an idle port is identified among at least two ports according to the occupancy status.

[0074] On this basis, an optional occupancy collection module is specifically used to:

[0075] Based on a preset time interval, occupancy status of at least two ports is collected.

[0076] Alternatively, a real service corresponding to the target honeypot is deployed on the target machine, and at least two ports include an occupied port occupied by the real service. The honeypot drainage device further includes:

[0077] The second flow detection module is used to detect the flow access situation on the occupied port;

[0078] The traffic forwarding module is used to forward the second access traffic to the real service when the second access traffic on the occupied port is detected.

[0079] On this basis, optionally, the target honeypot is located in the honeynet, and the real service and the honeypot probe serving as the honeypot entrance of the target honeypot are located in the target network, so that the network interconnection protocol of the honeypot entrance is the same as the network interconnection protocol of the real service.

[0080] Optionally, at least two honeypots are deployed in the honeynet that is in communication with the target machine, and the honeypot drainage device further includes:

[0081] The target honeypot determination module is used to determine the target honeypot to which the target port is mapped from at least two honeypots.

[0082] Based on any of the above devices, optionally, the target machine is a business machine.

[0083] The honeypot drainage device provided by the embodiment of the present invention is configured on the host security, and the host security is deployed on the target machine. The host security is integrated with a honeypot probe. The target port in the target machine is associated with the honeypot probe. The target port is in an idle state before being associated with the honeypot probe. The device detects the traffic access on the target port through the cooperation of the first traffic detection module and the honeypot drainage module, and when the first access traffic on the target port is detected, the first access traffic can be introduced into the target honeypot mapped by the target port through the honeypot probe to complete the honeypot drainage. The above device, by integrating the honeypot probe on the host security, can use the host security to automatically identify the idle ports on the target machine and associate these idle ports with the honeypot probe to perform honeypot drainage, thereby maximizing the honeypot drainage.

[0084] The honeypot drainage device provided in the embodiment of the present invention can execute the honeypot drainage method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0085] It is worth noting that in the embodiment of the above-mentioned honeypot drainage device, the various units and modules included are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention.

[0086] Figure 6The structural schematic diagram of the target machine 10 that can be used to implement an embodiment of the present invention is shown. The target machine is deployed with host security, and a honeypot probe is integrated on the host security. The target port in the target machine is associated with the honeypot probe, and the target port is idle before being associated with the honeypot probe, and the host security includes a computer program. The target machine is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The target machine can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples, and are not intended to limit the implementation of the present invention described and / or required herein.

[0087] like Figure 6 As shown, the target machine 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the target machine 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0088] A number of components in the target machine 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the target machine 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0089] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the honeypot drainage method.

[0090] In some embodiments, the honeypot drainage method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the target machine 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the honeypot drainage method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the honeypot drainage method in any other appropriate manner (e.g., by means of firmware).

[0091] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0092] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.

[0093] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0094] To provide interaction with a user, the systems and techniques described herein may be implemented on a target machine having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the target machine. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0095] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0096] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0097] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0098] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A honeypot drainage method, characterized in that: Applied to host security, the host security is deployed on a target machine, a honeypot probe is integrated on the host security, a target port in the target machine is associated with the honeypot probe, and the target port is in an idle state before being associated with the honeypot probe. The method includes: Detecting traffic access on the target port; When the first access traffic on the target port is detected, the first access traffic is introduced into the target honeypot mapped to the target port through the honeypot probe.

2. The method according to claim 1, characterized in that The target machine includes at least two ports, and the method further includes: Collecting the occupancy status of the at least two ports; When it is identified that there is an idle port among the at least two ports according to the occupancy situation, the idle port is used as the target port and associated with the honeypot probe.

3. The method according to claim 2, characterized in that The collecting of occupancy status of the at least two ports includes: Based on a preset time interval, the occupancy status of the at least two ports is collected.

4. The method according to claim 2, characterized in that: A real service corresponding to the target honeypot is deployed on the target machine, the at least two ports include an occupied port occupied by the real service, and the method further includes: Detecting traffic access status on the occupied port; When second access traffic on the occupied port is detected, the second access traffic is forwarded to the real service.

5. The method according to claim 4, characterized in that The target honeypot is located in the honeynet, the real service and the honeypot probe as the honeypot entrance of the target honeypot are located in the target network, so that the network interconnection protocol of the honeypot entrance is the same as the network interconnection protocol of the real service.

6. The method according to claim 1, characterized in that At least two honeypots are deployed in a honeynet that is in communication with the target machine, and the method further includes: The target honeypot to which the target port is mapped is determined from the at least two honeypots.

7. The method according to any one of claims 1 to 6, characterized in that The target machine is a business machine.

8. A honeypot drainage device, characterized in that: The device is configured for host security, the host security is deployed on a target machine, a honeypot probe is integrated on the host security, a target port in the target machine is associated with the honeypot probe, and the target port is in an idle state before being associated with the honeypot probe. The device includes: A first flow detection module, used for detecting flow access conditions on the target port; The honeypot diversion module is used to, when detecting the first access traffic on the target port, guide the first access traffic into the honeypot mapped by the honeypot probe through the honeypot probe.

9. A target machine, characterized in that: The target machine is deployed with host security, the host security is integrated with a honeypot probe, a target port in the target machine is associated with the honeypot probe, the target port is in an idle state before being associated with the honeypot probe, the host security includes a computer program, and the target machine includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores the computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor executes the honeypot drainage method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the honeypot drainage method as described in any one of claims 1 to 7 when executed.

11. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the computer program implements the honeypot drainage method according to any one of claims 1 to 7.

Images