Port deployment method and device, electronic equipment and storage medium

Abstract

The invention relates to a port deployment method and device, electronic equipment and a storage medium. The method comprises the steps of obtaining a configuration file used for deploying a target program; determining a to-be-deployed port for deploying the target program according to the to-be-deployed port number in the configuration file; determining first port information of the port to be deployed; detecting the to-be-deployed port according to the first port information to obtain occupied information of the to-be-deployed port; under the condition that the to-be-deployed port is determined to be occupied according to the occupied information, selecting an unoccupied target port from the candidate ports according to a preset scheme; and deploying the target program to the target port. According to the method, whether the port to be deployed is occupied or not is determined firstly, and then whether the target program is deployed to the port to be deployed or not is judged, so that the situation that installation and deployment of the target program fail due to port conflicts can be effectively avoided, and the installation and deployment efficiency of the target program can be effectively improved.

Description

Technical Field

[0001] The present application relates to the field of application deployment technology, and in particular to a port deployment method and device, an electronic device, and a storage medium. Background Art

[0002] When deploying a decoy node on a business host, since the business host may have occupied some service ports, if the decoy node is deployed without checking the port occupation, the deployment may fail due to port conflicts. For example, if the business host has opened the web service on port 80, if the decoy node needs to be deployed on port 80, the deployment will fail because port 80 has been occupied by the web service of the business host.

[0003] With respect to the technical problem that port conflicts are prone to occur during port deployment in related technologies, no effective solution has been provided so far. Summary of the invention

[0004] In order to solve the technical problem that port conflicts are likely to occur during the above-mentioned port deployment, the present application provides a port deployment method and device, an electronic device and a storage medium.

[0005] In a first aspect, an embodiment of the present application provides a port deployment method, comprising: obtaining a configuration file for deploying a target program; determining a port to be deployed for deploying the target program according to a port number to be deployed in the configuration file; determining first port information of the port to be deployed; detecting the port to be deployed according to the first port information to obtain occupied information of the port to be deployed, wherein the occupied information is used to indicate whether the port to be deployed has been occupied by other programs; in a case where it is determined according to the occupied information that the port to be deployed has been occupied, selecting an unoccupied target port from the candidate ports according to a preset plan; and deploying the target program to the target port.

[0006] Optionally, as in the aforementioned method, the first port information includes: the port number to be deployed and port type information; the detecting the port to be deployed according to the first port information to obtain the occupied information of the port to be deployed includes: determining the port type information of the port to be deployed; in a candidate query method, obtaining a target query method corresponding to the port to be deployed according to the port type information; querying the port number to be deployed through the target query method to obtain the occupied information of the port to be deployed.

[0007] Optionally, as in the aforementioned method, determining the port type information of the port to be deployed includes: determining the target system type of the host where the port to be deployed is located and the target port type of the port to be deployed; in the candidate query method, obtaining the target query method corresponding to the port to be deployed according to the port type information by querying includes: in the candidate query method, obtaining the target query method corresponding to the port to be deployed according to the target system type and the target port type by querying.

[0008] Optionally, as in the aforementioned method, after detecting the port to be deployed and obtaining the occupied information of the port to be deployed, the method also includes: determining a current trapping node deployed on the port to be deployed when it is determined that the port to be deployed is not occupied according to the occupied information; determining a first attack number of attacks received by the current trapping node in a current time period, wherein the first attack number includes the number of all attacks received by the current trapping node in the current time period; when the first attack number is less than a preset lower limit, obtaining a historical attack number received by the current trapping node in a first historical time period, wherein the first historical time period is a historical time period corresponding to the current time period; when the numerical relationship between the first attack number and the historical attack number meets a preset condition, undeploying the current trapping node; releasing the occupied state of the port to be deployed; and deploying the target program to the port to be deployed.

[0009] Optionally, as in the aforementioned method, the selecting an unoccupied target port from the candidate ports according to a preset scheme includes: determining a deviation value between the candidate port number of each of the candidate ports and the port number to be deployed, wherein the deviation value is used to indicate the absolute value of the difference between the candidate port number of the candidate port and the port number to be deployed; determining the occupancy status of each of the candidate ports in order from small to large according to the deviation values, until the target port is determined among all the candidate ports, wherein the occupancy status is used to indicate whether the candidate port has been occupied by other programs, and the target port is the candidate port with the smallest deviation value among all the candidate ports that are not occupied by other programs.

[0010] Optionally, as in the aforementioned method, deploying the target program to the target port includes: modifying the configuration file according to the target port number of the target port to obtain the target configuration file; receiving a deployment trigger instruction for deploying the target configuration file to trigger the target program to read the target port number in the target configuration file, and deploy the target program to the target port according to the target port number.

[0011] Optionally, as in the aforementioned method, before obtaining the configuration file for deploying the target program, the method also includes: obtaining historical attack information of attacks received by each candidate business node in the second historical time period, wherein the historical attack information includes the second attack number of attacks received by each candidate business node in the second historical time period; determining, based on the historical attack information, the target business node with the largest number of the second attack numbers among all candidate business nodes that do not have corresponding trapping nodes deployed; and querying the target trapping program corresponding to the target business node that is the target program among all candidate trapping programs.

[0012] Optionally, as in the aforementioned method, after detecting the port to be deployed and obtaining occupation information of the port to be deployed, the method further includes: when it is determined according to the occupation information that the port to be deployed is not occupied, deploying the target program to the port to be deployed.

[0013] In the second aspect, an embodiment of the present application provides a port deployment device, comprising: an acquisition module, used to acquire a configuration file for deploying a target program; a first determination module, used to determine the port to be deployed for deploying the target program according to the port number to be deployed in the configuration file; a second determination module, used to determine the first port information of the port to be deployed; a detection module, used to detect the port to be deployed according to the first port information to obtain occupation information of the port to be deployed, wherein the occupied information is used to indicate whether the port to be deployed has been occupied by other programs; a selection module, used to select an unoccupied target port from the candidate ports according to a preset scheme when it is determined that the port to be deployed has been occupied according to the occupied information; and a deployment module, used to deploy the target program to the target port.

[0014] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; the memory is used to store a computer program; and the processor is used to implement any of the methods described above when executing the computer program.

[0015] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the storage medium includes a stored program, wherein the program executes a method as described in any of the preceding items when executed.

[0016] The embodiment of the present application provides a port deployment method and device, an electronic device and a storage medium. Among them, the port deployment method includes: obtaining a configuration file for deploying a target program; determining a port to be deployed for deploying the target program according to the port number to be deployed in the configuration file; determining the first port information of the port to be deployed; detecting the port to be deployed according to the first port information to obtain the occupied information of the port to be deployed, wherein the occupied information is used to indicate whether the port to be deployed has been occupied by other programs; in the case where it is determined that the port to be deployed has been occupied according to the occupied information, selecting an unoccupied target port from the candidate ports according to a preset scheme; deploying the target program to the target port. The above-mentioned technical solution provided by the embodiment of the present application has the following advantages compared with the prior art: by first determining whether the port to be deployed is occupied, and then judging whether to deploy the target program to the port to be deployed, the situation where the installation and deployment of the target program fails due to port conflicts can be effectively avoided, and the efficiency of the installation and deployment of the target program can be effectively improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0018] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0019] Figure 1 A flow chart of a port deployment method provided in an embodiment of the present application;

[0020] Figure 2 A flow chart of a port deployment method provided in another embodiment of the present application;

[0021] Figure 3 A flow chart of a port deployment method provided in another embodiment of the present application;

[0022] Figure 4 A flow chart of a port deployment method provided in another embodiment of the present application;

[0023] Figure 5 A block diagram of a port deployment device provided in an embodiment of the present application;

[0024] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0025] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0026] According to one aspect of an embodiment of the present application, a port deployment method is provided. Optionally, in this embodiment, the port deployment method can be applied to a hardware environment composed of a terminal and / or a server.

[0027] The port deployment method of the embodiment of the present application can be executed by a server, a terminal, or a server and a terminal together. The terminal can also execute the port deployment method of the embodiment of the present application by a client installed thereon.

[0028] Taking the port deployment method in this embodiment executed by the server as an example, Figure 1 A port deployment method provided in an embodiment of the present application includes the following steps:

[0029] Step S101, obtaining a configuration file for deploying a target program.

[0030] The port deployment method in this embodiment can be applied to the scenario of deploying nodes on a business host, for example, deploying a trapping node on a business host, etc., or it can be applied to the scenario of deploying other types of nodes on a business host. In the embodiment of the present application, the above port deployment method is described by taking the deployment of a trapping node to a port of a business host as an example. For other types of nodes, the above port deployment method is also applicable if there is no contradiction.

[0031] Taking the scenario of deploying the installation program of the decoy node to the service host as an example, the target port for deploying the decoy node is determined among all the ports by performing abnormal identification on all the ports on the service host.

[0032] The configuration file may include port information (eg, port number) for indicating the port to which the target program needs to be deployed, so that the target program can be deployed to the corresponding port according to the configuration file.

[0033] Generally, a corresponding configuration file may be set for each program that needs to be deployed on the service host, so that each program can be deployed to a corresponding interface according to the configuration file.

[0034] Step S102, determining the port to be deployed for deploying the target program according to the port number to be deployed in the configuration file.

[0035] Since the configuration file may include port information for indicating the port to which the target program needs to be deployed, and generally, a business host includes multiple ports, and the port information of each port is represented by a port number, and there is a one-to-one correspondence between the port number and the port, after obtaining the configuration file, the port number of the port to be deployed in the business host for deploying the target program recorded in the configuration file can be obtained.

[0036] The port number to be deployed is recorded in the configuration file and is used to indicate the port number of the port to be deployed to which the target program is deployed.

[0037] After obtaining the port number to be deployed, the port to be deployed on the business host where the target program is deployed can be queried according to the port number to be deployed.

[0038] Step S103: determining first port information of the port to be deployed.

[0039] After the port to be deployed is found, information of the port to be deployed may be queried to obtain first port information corresponding to the port to be deployed.

[0040] The first port information may include information for describing the port to be deployed, such as the port number, the system type of the host where the port is located, the port type, and the like.

[0041] Step S104: detecting the port to be deployed according to the first port information to obtain occupation information of the port to be deployed, wherein the occupation information is used to indicate whether the port to be deployed has been occupied by other programs.

[0042] After the first port information is obtained, a detection method for detecting the port to be deployed may be determined according to the first port information, and then the port to be deployed may be detected according to the detection method to obtain occupation information of the port to be deployed.

[0043] The occupied information may be information used to indicate whether the port to be deployed has been occupied by other programs.

[0044] Step S105 : when it is determined according to the occupied information that the port to be deployed is occupied, an unoccupied target port is selected from the candidate ports according to a preset scheme.

[0045] After obtaining the occupied information, it can be determined whether the port to be deployed has been occupied by other applications.

[0046] When it is determined according to the occupied information that the port to be deployed has been occupied by other applications, an unoccupied target port can be selected from the candidate ports according to a preset scheme.

[0047] The candidate ports may be other ports in the service host except the ports to be deployed.

[0048] The preset scheme may be a selection method for selecting an unoccupied target port from among all candidate ports. For example, querying the occupancy of each port in turn according to the port number and selecting an unoccupied target port; querying the occupancy of each port in turn according to the port type of each port and selecting an unoccupied target port, etc.

[0049] The target port may be the first port selected from all candidate ports that is not occupied by other programs.

[0050] Step S106, deploying the target program to the target port.

[0051] After determining the target port, the target program can be deployed to the target port to deploy the target program. For example, the installation program of the trap node can be deployed to the target port to complete the installation and deployment of the trap node on the service host. Deploying the target program to the port to be deployed can be allocating the target port to the target program.

[0052] As an optional implementation, as in the above method, after detecting the port to be deployed in step S104 and obtaining the occupied information of the port to be deployed, the method further includes the following steps:

[0053] When it is determined according to the occupied information that the port to be deployed is not occupied, the target program is deployed to the port to be deployed.

[0054] After obtaining the occupied information, it can be determined whether the port to be deployed has been occupied by other applications.

[0055] If the port to be deployed is determined to be not occupied by other applications according to the occupied information, the target program can be deployed to the target port to deploy the target program. For example, the installation program of the trap node can be deployed to the port to be deployed to complete the installation and deployment of the trap node on the service host.

[0056] The method in this embodiment can effectively avoid the failure of target program installation and deployment caused by port conflict by first determining whether the port to be deployed is occupied and then determining whether to deploy the target program to the port to be deployed, thereby effectively improving the efficiency of target program installation and deployment.

[0057] like Figure 2As shown, as an optional implementation, as in the aforementioned method, the first port information includes: the port number to be deployed and the port type information; the step S104 detects the port to be deployed according to the first port information, and obtains the occupied information of the port to be deployed, including the following steps:

[0058] Step S201: determine the port type information of the port to be deployed.

[0059] Step S202: in a candidate query mode, query and obtain a target query mode corresponding to the port to be deployed according to the port type information.

[0060] Step S203, querying the port number to be deployed in a target query manner to obtain occupation information of the port to be deployed.

[0061] Since the first port information includes the port number to be deployed and the port type information of the port to be deployed in the treasure house, the port type information of the port to be deployed can be determined.

[0062] Each type of port information may have a corresponding query method.

[0063] The candidate query method may be a query method corresponding to different port type information; for example, each candidate query method may be associated with a keyword of the port type information, and then a target query method for querying occupied information of the port to be deployed may be obtained by querying the port type information.

[0064] After obtaining the target query method, since the port number to be deployed is information uniquely corresponding to the port to be deployed, the port number to be deployed can be queried through the target query method to obtain occupation information of the port to be deployed.

[0065] Through the method in this embodiment, the occupation status of the ports to be deployed can be quickly queried.

[0066] As an optional implementation, as in the above method,

[0067] The step of determining the port type information of the port to be deployed includes:

[0068] Step S301, determining the target system type of the host where the port to be deployed is located and the target port type of the port to be deployed.

[0069] The target system type is used to characterize the type of the host system where the port is located, for example, Linux, Windows, etc.

[0070] The target port type is information used to characterize the port type of the port to be deployed, for example, a TCP port, a UDP port, and the like.

[0071] The step of obtaining the target query method corresponding to the port to be deployed according to the port type information in the candidate query method includes:

[0072] Step S302: In the candidate query mode, query and obtain the target query mode corresponding to the port to be deployed according to the target system type and the target port type.

[0073] After determining the target system type of the host where the port to be deployed is located and the target port type of the port to be deployed, the target query method corresponding to the port to be deployed can be determined from all candidate query methods.

[0074] Target query methods may include but are not limited to:

[0075] When the target system type of the service host is Linux:

[0076] Detect the TCP port: netstat -anlpt | grep the port number to be detected.

[0077] Check the UDP port: netstat -anlpu | grep the port number to be checked.

[0078] When the target system type of the service host is Windows:

[0079] Detect TCP port:

[0080] netstat-ano|findstr TCP|findstr The port number to be detected.

[0081] Detect UDP port:

[0082] netstat-ano|findstr UDP|findstr the port number to be detected.

[0083] For example, if you need to check whether the target system type is Linux, the target port type is TCP, and the port number 22 to be deployed is occupied, you can get the occupied information of the port to be deployed by executing the following execution command:

[0084] netstat -anlpt |grep 22;

[0085] After executing the command, you can check whether the port is occupied from the occupied information. If the result is empty, it means that the port to be deployed is not occupied and the decoy node can be deployed on the port.

[0086] As an optional implementation, as in the above method, after detecting the port to be deployed in step S104 and obtaining the occupied information of the port to be deployed, the method further includes the following steps:

[0087] Step S401: when it is determined according to the occupied information that the port to be deployed is occupied, determine the current trapping node deployed on the port to be deployed.

[0088] After determining the port to be deployed, the application currently occupying the port to be deployed can be determined by the method in the above embodiment. When the application is a trapping program, what is currently deployed on the port to be deployed is the current trapping node obtained after installing the trapping program.

[0089] Step S402: determining a first attack count of attacks received by the current decoy node in the current time period, wherein the first attack count includes the count of all attacks received by the current decoy node in the current time period.

[0090] After the current decoy node is determined, since the current decoy node is a node for performing an attracting attack, the first number of attacks received by the current decoy node in the current time period may be determined.

[0091] The current time period can be a time period that ends at the current time point, and the starting time is separated from the current time point by a preset time period; for example, when the preset time period is 1 hour and the current time point is 12:00, the current time period is [11:00:01, 12:00:00].

[0092] Determining the first number of attacks received by the current trapping node in the current time period can be: each time an attack is received, the attack information of the attack is recorded, which may include but is not limited to: attack time, attacker information, and attack type, etc.; then, the attack time of the attack information is filtered from the two time points at the beginning and end of the current time period, and the first number of attacks received in the current time period can be obtained.

[0093] Step S403, when the first attack number is less than the preset lower limit, obtain the historical attack number received by the current trapping node in the first historical time period, wherein the first historical time period is a historical time period corresponding to the current time period.

[0094] The preset lower limit of the number of times can be a pre-set value for classifying the first number of attacks; and when the first number of attacks is greater than or equal to the preset lower limit of the number of times, it is determined that the number of attacks received in the first time period is large, and therefore the current trapped node needs to be retained; when the first number of attacks is less than the preset lower limit of the number of times, it is determined that the number of attacks received in the first time period is small, and therefore there is a possibility that the current trapped node can be deleted.

[0095] The first historical time period is the historical time period corresponding to the current time period, which may be: the first historical time period and the current time period are in the same time period on different days, or on the same day in different weeks, etc.; for example, when the current time period is [11:00:01,12:00:00] on June 10, 2021, if the first historical time period and the current time period are in the same time period on different days, the first historical time period may be [11:00:01,12:00:00] on June 9, 2021, [11:00:01,12:00:00] on June 8, 2021, etc.; the number of historical attacks may be the number of attacks in the first historical time period closest to the current time period, or may be the average value obtained by averaging multiple first historical attack numbers.

[0096] Step S404: when the numerical relationship between the first attack number and the historical attack number meets a preset condition, the current trapping node is released.

[0097] The preset condition may be that the difference between the first attack number and the historical attack number is greater than a preset difference threshold, or the ratio between the first attack number and the historical attack number is less than a preset ratio threshold.

[0098] When the numerical relationship between the first number of attacks and the historical number of attacks meets the preset conditions, it means that the first number of attacks is much smaller than the historical number of attacks. Therefore, the number of attacks that the trapping node can attract is too small. If the trapping node is still deployed, the impact on security is small, and it will continue to occupy system resources, resulting in a waste of resources. Therefore, in this case, the current trapping node is undeployed.

[0099] Optionally, you can determine the process ID corresponding to the current decoy node and use the taskkill / f / pid PID command to kill the process occupying the port. PID is the process ID.

[0100] Step S405: cancel the occupied state of the port to be deployed.

[0101] After the current trapping node is undeployed, the occupied state of the port to be deployed can be released.

[0102] Step S406, deploying the target program to the port to be deployed.

[0103] Further, after the occupied state of the port to be deployed is released, the port to be deployed is in an unoccupied state. Therefore, when it is determined according to the occupied information that the port to be deployed is unoccupied, the target program can be deployed to the port to be deployed.

[0104] Through the method in this embodiment, it can be determined whether the current trapping node deployed on the port to be deployed can be undeployed according to the number of attacks corresponding to the port to be deployed, so as to be used to deploy the target program. When the deployment is completed, it can also be avoided that the trapping node with a small number of attacks attracted occupies computing resources.

[0105] like Figure 3 As shown, as an optional implementation, as in the above method, the step S105 of selecting an unoccupied target port from the candidate ports according to a preset scheme includes the following steps:

[0106] Step S501 : determining a deviation value between a candidate port number of each candidate port and a port number to be deployed, wherein the deviation value is used to indicate an absolute value of a difference between the candidate port number of the candidate port and the port number to be deployed.

[0107] The candidate ports are ports other than the port to be deployed on the business host where the target program is deployed. Therefore, each candidate port also has a unique corresponding candidate port number, and each candidate port number is different from the port number to be deployed.

[0108] The port numbers are all represented by numerical values, so the deviation value between each candidate port number and the port number to be deployed can be calculated.

[0109] The deviation value is used to indicate the absolute value of the difference between the candidate port number of the candidate port and the port number to be deployed. For example, when the port number to be deployed is 22 and the candidate port number a of candidate port A is 24, the deviation value between the candidate port number a and the port number to be deployed is |22-24|=2; when the candidate port number b of candidate port B is 15, the deviation value between the candidate port number b and the port number to be deployed is |22-15|=7.

[0110] Step S502, determining the occupancy status of each candidate port in order from small to large deviation values ​​until a target port is determined among all candidate ports, wherein the occupancy status is used to indicate whether the candidate port has been occupied by other programs, and the target port is the candidate port with the smallest deviation value among all candidate ports not occupied by other programs.

[0111] After determining the deviation value corresponding to each candidate port, the candidate ports can be sorted in order of the deviation value from small to large to obtain a port sequence; then starting from the candidate port with the smallest deviation value, the occupancy status of each candidate port is determined in turn according to the port sequence. When it is determined that the occupancy status of a candidate port indicates that the candidate port is not occupied by other programs, the candidate port is recorded as the target port. At this time, the target port selected is the candidate port with the smallest deviation value among all candidate ports that are not occupied by other programs.

[0112] Through the method in this embodiment, a candidate port closest to the originally planned port to be deployed can be selected as the target port, which facilitates overall management and control of application deployment of each port.

[0113] As an optional implementation, as in the above method, the step S106 of deploying the target program to the target port includes the following steps:

[0114] Step S601, modifying the configuration file by the target port number of the target port to obtain a target configuration file.

[0115] After the target port is determined, it is determined that the target program needs to be deployed to the target port. At the same time, since the target program needs to be deployed according to the configuration file, the configuration file needs to be modified according to the target port number of the target port.

[0116] The configuration file can be modified in the following ways: writing the target port number into the configuration file to obtain the target configuration file, so that the target program can later determine the target port to be deployed based on the target port number that was most recently written (for example, judging the time when each port number was written into the configuration file based on the time when the configuration file was written); or overwriting the port number to be deployed in the configuration file with the target port number to obtain the target configuration file, so that the target program can later determine the target port to be deployed based on the unique target port number in the target configuration file.

[0117] Step S602, receiving a deployment trigger instruction for deploying a target configuration file, so as to trigger the target program to read the target port number in the target configuration file, and deploy the target program to the target port according to the target port number.

[0118] After obtaining the target configuration file, the target program can be installed and deployed according to the target configuration file.

[0119] When deploying the target program, you can achieve the purpose of triggering the generation of a deployment trigger instruction by, for example, clicking a "deploy" control. After receiving the deployment trigger instruction, you can start installing and deploying the target program.

[0120] The target program can obtain the target port number by reading the target configuration file, determine the target port corresponding to the target port number to be deployed to the target program, and finally deploy the target program to the target port according to the target port number to complete the deployment of the target program.

[0121] like Figure 4 As shown, as an optional implementation, as in the above method, before the step S101 obtains the configuration file for deploying the target program, the method further includes the following steps:

[0122] Step S701: Acquire historical attack information of attacks received by each candidate service node in a second historical time period, wherein the historical attack information includes a second attack number of attacks received by each candidate service node in the second historical time period.

[0123] When the program to be deployed is a trap program, the target trap program to be deployed preferentially can be determined according to the attack situation of the candidate service nodes corresponding to each trap program lock.

[0124] The second historical time period may be a pre-set time period before the current time point. After determining the second historical time period, statistics may be collected on the attacks received by each candidate service node in the second historical time period to obtain historical attack information.

[0125] The historical attack information may include the second attack times received by each candidate service node in the second historical time period, and may also include the identity information and number of attackers who attacked each candidate service node in the second historical time period.

[0126] Step S702: According to the historical attack information, a target service node with the second largest number of attacks is determined from among all candidate service nodes that are not deployed with corresponding decoy nodes.

[0127] For a server implementing the method of this embodiment, it is possible to determine whether each service node has been deployed with a corresponding decoy node, and thus, it is possible to determine candidate service nodes that are not deployed with corresponding decoy nodes among all service nodes.

[0128] Since the historical attack information includes the second attack times received by each candidate service node in the second historical time period, the target service node with the largest second attack times can be determined from among all candidate service nodes according to the historical attack information.

[0129] Step S703: Query all candidate decoy programs to find a target decoy program corresponding to a target service node as a target program.

[0130] Candidate trapping programs corresponding to each service node may be stored in advance in the target storage area, and the candidate trapping programs may be identified by feature information of the service node corresponding to the candidate trapping programs.

[0131] After determining the target business node, the target trapping program corresponding to the target business node can be queried from all candidate trapping programs through the target feature information of the target business node, and the target trapping program can be used as the target program. Then, the trapping node can be installed and deployed according to the target program.

[0132] Through the method in this embodiment, the target trapping program that needs to be deployed first can be determined according to the historical attack information of attacks received by each service node, which can effectively improve the security of the service node.

[0133] like Figure 5 As shown, according to an embodiment of another aspect of the present application, a port deployment device is also provided, including:

[0134] Acquisition module 1, used to acquire a configuration file for deploying a target program;

[0135] A first determination module 2, used to determine the port to be deployed for deploying the target program according to the port number to be deployed in the configuration file;

[0136] A second determination module 3, used to determine first port information of a port to be deployed;

[0137] A detection module 4 is used to detect the port to be deployed according to the first port information to obtain occupation information of the port to be deployed, wherein the occupation information is used to indicate whether the port to be deployed has been occupied by other programs;

[0138] A selection module 5 is used to select an unoccupied target port from the candidate ports according to a preset scheme when it is determined that the port to be deployed is occupied according to the occupied information;

[0139] The deployment module 6 is used to deploy the target program to the target port.

[0140] Specifically, the specific process of each module in the device of the embodiment of the present invention realizing its function can be referred to the relevant description in the method embodiment, which will not be repeated here.

[0141] According to another embodiment of the present application, there is also provided an electronic device, including: Figure 6 As shown, the electronic device may include: a processor 1501 , a communication interface 1502 , a memory 1503 and a communication bus 1504 , wherein the processor 1501 , the communication interface 1502 , and the memory 1503 communicate with each other via the communication bus 1504 .

[0142] Memory 1503, used for storing computer programs;

[0143] The processor 1501 is used to implement the steps of the above method embodiment when executing the program stored in the memory 1503.

[0144] The bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0145] The communication interface is used for communication between the above electronic device and other devices.

[0146] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0147] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0148] An embodiment of the present application further provides a computer-readable storage medium, the storage medium including a stored program, wherein the method steps of the above method embodiment are executed when the program is run.

[0149] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0150] The foregoing is merely a specific embodiment of the present invention, which enables those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A port deployment method, characterized in that: include: Get the configuration file used to deploy the target program; Determine the port to be deployed for deploying the target program according to the port number to be deployed in the configuration file; Determine first port information of the port to be deployed; Detecting the port to be deployed according to the first port information to obtain occupation information of the port to be deployed, wherein the occupation information is used to indicate whether the port to be deployed has been occupied by other programs; When it is determined according to the occupied information that the port to be deployed is occupied, selecting an unoccupied target port from the candidate ports according to a preset scheme; Deploy the target program to the target port.

2. The method according to claim 1, characterized in that The first port information includes: the port number to be deployed and port type information; the detecting the port to be deployed according to the first port information to obtain the occupied information of the port to be deployed includes: Determine the port type information of the port to be deployed; In the candidate query mode, a target query mode corresponding to the port to be deployed is obtained by querying according to the port type information; The port number to be deployed is queried in the target query mode to obtain occupation information of the port to be deployed.

3. The method according to claim 2, characterized in that The determining of the port type information of the port to be deployed includes: Determine the target system type of the host where the port to be deployed is located and the target port type of the port to be deployed; In the candidate query mode, the target query mode corresponding to the port to be deployed is obtained by querying the port type information, including: In the candidate query mode, the target query mode corresponding to the port to be deployed is obtained by querying according to the target system type and the target port type.

4. The method according to claim 1, characterized in that After detecting the port to be deployed and obtaining the occupation information of the port to be deployed, the method further includes: In the case where it is determined according to the occupied information that the port to be deployed is occupied, determining a current trapping node deployed on the port to be deployed; Determine a first attack number of attacks received by the current decoy node in a current time period, wherein the first attack number includes the number of all attacks received by the current decoy node in the current time period; When the first attack number is less than a preset lower limit, obtaining a historical attack number received by the current trapping node in a first historical time period, wherein the first historical time period is a historical time period corresponding to the current time period; When the numerical relationship between the first attack number and the historical attack number meets a preset condition, de-deploying the current trapping node; Releasing the occupied state of the port to be deployed; Deploy the target program to the port to be deployed.

5. The method according to claim 1, characterized in that The step of selecting an unoccupied target port from the candidate ports according to a preset scheme comprises: Determine a deviation value between a candidate port number of each candidate port and the port number to be deployed, wherein the deviation value is used to indicate an absolute value of a difference between the candidate port number of the candidate port and the port number to be deployed; The occupancy status of each candidate port is determined in order from small to large in the order of the deviation value until the target port is determined among all the candidate ports, wherein the occupancy status is used to indicate whether the candidate port has been occupied by other programs, and the target port is the candidate port with the smallest deviation value among all the candidate ports that are not occupied by other programs.

6. The method according to claim 1, characterized in that Deploying the target program to the target port includes: Modify the configuration file by the target port number of the target port to obtain a target configuration file; A deployment trigger instruction for deploying the target configuration file is received to trigger the target program to read the target port number in the target configuration file and deploy the target program to the target port according to the target port number.

7. The method according to any one of claims 1 to 6, characterized in that: After detecting the port to be deployed and obtaining the occupation information of the port to be deployed, the method further includes: When it is determined according to the occupied information that the port to be deployed is not occupied, the target program is deployed to the port to be deployed.

8. A port deployment device, characterized in that: include: An acquisition module, used to acquire a configuration file for deploying a target program; A first determination module, used to determine the port to be deployed for deploying the target program according to the port number to be deployed in the configuration file; A second determining module, used to determine first port information of the port to be deployed; a detection module, configured to detect the port to be deployed according to the first port information, and obtain occupation information of the port to be deployed, wherein the occupation information is used to indicate whether the port to be deployed has been occupied by other programs; A selection module, configured to select an unoccupied target port from the candidate ports according to a preset scheme when it is determined according to the occupied information that the port to be deployed is occupied; A deployment module is used to deploy the target program to the target port.

9. An electronic device, characterized in that: include: A processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus; The memory is used to store computer programs; The processor is used to implement the method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that: The storage medium includes a stored program, wherein the program executes the method according to any one of claims 1 to 7 when executed.

Images