Industrial honeypot high interaction method and system based on encoder and decoder

Abstract

The invention relates to the technical field of honeypot interaction, in particular to an industrial honeypot high-interaction method and system based on an encoder and a decoder. The method comprises the following steps: acquiring water treatment data; training a coder-decoder model by using the obtained water treatment data, and carrying out loss function calculation on the output of the coder-decoder model; after the maximum training round number R is reached, model training is stopped, and model parameters are saved; generating long-term simulation data from the stored model parameters, and writing the long-term simulation data into a register numerical value configuration file according to a time sequence; and responding to a request of an attacker by utilizing a honeypot according to the generated register numerical value configuration file. According to the method, the quantile loss function smoothed through the Huber norm is used for replacing a common MSE loss function, abnormal values can be prevented from being generated in the simulation process, and the simulation duration can be effectively prolonged.

Description

Technical Field

[0001] The present invention relates to the field of honeypot interaction technology, and in particular to an industrial honeypot high-interaction method and system based on an encoder and a decoder. Background Art

[0002] Compared with traditional network security, industrial security needs to ensure network security while ensuring production efficiency. Usually, industrial security mainly relies on bypass protection mechanisms to ensure network communications and resist network security threats, which makes honeypot technology effectively applied in the field of industrial network security.

[0003] Honeypots simulate the behavior of real devices and deliberately expose their own ports, services and other related information during the deployment process to attract attackers. They can effectively capture attackers' behavior and analyze their attack methods and motivations. The interactivity of honeypots determines the value of honeypots. Honeypots with high interactivity can effectively respond to various request messages from attackers and enhance the deception ability of honeypots. However, most honeypots currently used in industrial networks cannot give reasonable responses to attackers' industry-specific sniffing behaviors. Such honeypots are easily identified and marked by attackers and cannot further capture the attackers' malicious behaviors. Therefore, improving the interactivity of honeypots is of great significance for quickly discovering threats in industrial networks and providing effective protection strategies for industrial network security.

[0004] "Yamamoto M, Kakei S, Saito S. Firmpot: A framework for intelligent-interaction honeypots using firmware of iot devices[C]. 2021 NinthInternational Symposium on Computing and Networking Workshops (CANDARW).IEEE, 2021: 405-411." An intelligent interactive honeypot method is proposed, which obtains the relational corpus of requests and responses by forwarding the attacker's request message to the public network device, and trains a neural dialogue model for it to generate the best response message. However, once the dialogue model is established, it can only give the same response to the same request message. In real industrial scenarios, the register status of the device is constantly changing, and it should give different response messages for the same request at different times.

[0005] "Siniosoglou I, Argyriou V, Lagkas T, et al. Covert distributed training of deep federated industrial Honeypots[C] / / 2021 IEEE GlobecomWorkshops (GC Wkshps). IEEE, 2021: 1-6." A distributed honeypot method based on federated learning is proposed. This method generates register values ​​of the Modbus protocol by training an LSTM-Autoencoder prediction model on each honeypot, and uses the predicted values ​​to simulate the state changes of real industrial equipment. At the same time, federated learning can generate an optimal global model for all honeypot nodes to ensure the prediction accuracy of the model. Although this scheme can well replicate the state changes of real devices, its simulation of device states is short-term and requires continuous data exchange with real devices during honeypot deployment, which destroys the original network structure. In addition, this method focuses on device simulation and lacks effective response to attackers.

[0006] In summary, the existing industrial honeypot interaction methods have problems such as poor practicality, one-sided considerations, and being out of touch with actual scenarios, which makes them easily identified by attackers, thus losing their value and having low practicality and reference value. Summary of the invention

[0007] In order to solve the above-mentioned problems, the present invention provides a high-interaction method and system for industrial honeypots based on encoders and decoders. The encoder-decoder model is used to make the honeypot reflect the register state changes of real industrial equipment during the interaction with the attacker, so as to enhance the honeypot's deception ability.

[0008] In a first aspect, the present invention provides an industrial honeypot high-interaction method based on an encoder and a decoder, which adopts the following technical solution: An industrial honeypot high-interaction method based on an encoder and a decoder, comprising: Obtain water treatment data; The encoder-decoder model is trained using the acquired water treatment data, wherein a loss function is calculated for the output of the encoder-decoder model; the model training is stopped after reaching a maximum number of training rounds R, and the model parameters are saved; Generate long-term simulation data with the saved model parameters and write them into the register value configuration file in chronological order; The honeypot is used to respond to the attacker's request based on the generated register value profile.

[0009] Furthermore, the obtaining of water treatment data includes obtaining sampling values ​​of different sensors in the water treatment process within 7 days, with a sampling interval of minutes, specifically including LIT101 water tank sensor data, AIT203 sodium hypochlorite concentration sensor data, LIT301 ultrafiltration device water tank sensor data and LIT401 reverse osmosis water tank sensor data.

[0010] Furthermore, the use of the acquired water treatment data to train the encoder-decoder model includes inputting the data into the model's encoder to obtain its encoder hidden layer state, and then calculating the hidden layer state of the decoder at a certain moment, inputting the encoder and decoder hidden layer states at all moments into the attention module to obtain a context vector, and inputting the decoder hidden layer state and the context vector into the fully connected layer to obtain the output value of the model at this moment.

[0011] Furthermore, the output of the encoder-decoder model is subjected to loss function calculation, the Huber quantile loss function is calculated for the model output at each time point, and then the average loss function of the model is calculated. The Huber quantile loss function is expressed as: in represents the true value at time t, represents the target quantile, express The model output at the moment The values ​​of quantile, q, are 0.1, 0.5, and 0.9 respectively. is the Huber function. When the error between the true value and the model output value is Less than threshold =0.05, is the L2 loss function, otherwise, is the L1 loss function; Used to ensure single point loss function exist The function is differentiable at points, which enables it to be used for gradient descent training of neural networks.

[0012] Furthermore, the stored model parameters are used to generate long-term simulation data, including inputting the test register data as test data into the stored encoder-decoder model to obtain a single simulation result of the model, setting a reasonable range of register values, selecting rules to select simulation values ​​for output and backfilling them to the end of the test data, and shifting the test data back by T=50 bits, calculating the number of cycles required to generate all the simulation data, and stopping generating simulation data until the maximum number of cycles N is reached or the test data has a null value.

[0013] Furthermore, the writing into the register value configuration file in chronological order includes writing all generated simulation data into the register value configuration file in chronological order, converting each decimal simulation data into a 4-byte hexadecimal value according to the IEEE745 data conversion rules, and writing it into registers of two consecutive addresses according to the timestamp.

[0014] Furthermore, the honeypot is used to respond to the attacker's request according to the generated register value configuration file, including calculating the timestamp of the Modbus request data packet sent by the attacker, and using the honeypot to parse the Modbus request data packet sent by the attacker according to the protocol specification, and the parsed fields include transaction identifier, protocol identifier, length, unit identifier, function code, starting address, quantity and register value; the honeypot generates a response message to the attacker according to the set rules.

[0015] In the second aspect, an industrial honeypot high-interaction system based on an encoder and a decoder includes: A data acquisition module is configured to acquire water treatment data; The model training module is configured to train the encoder-decoder model using the acquired water treatment data, wherein a loss function is calculated for the output of the encoder-decoder model; the model training is stopped after a maximum number of training rounds R is reached, and the model parameters are saved; The data generation module is configured to generate long-term simulation data from the saved model parameters and write the data into a register value configuration file in chronological order; The response module is configured to respond to the attacker's request using the honeypot according to the generated register value profile.

[0016] In a third aspect, the present invention provides a computer-readable storage medium storing a plurality of instructions, wherein the instructions are suitable for being loaded and executed by a processor of a terminal device, for example, an industrial honeypot high-interaction method based on an encoder and a decoder.

[0017] In a fourth aspect, the present invention provides a terminal device comprising a processor and a computer-readable storage medium, wherein the processor is used to implement various instructions; the computer-readable storage medium is used to store multiple instructions, and the instructions are suitable for being loaded and executed by the processor to implement the industrial honeypot high-interaction method based on an encoder and a decoder.

[0018] In summary, the present invention has the following beneficial technical effects: (1) This application proposes a codec model for long-term simulation of the register status of industrial equipment. This model replaces the commonly used MSE loss function with the quantile loss function smoothed by the Huber norm, which can avoid the generation of outliers during the simulation process and effectively extend the simulation time. (2) This application proposes a high-interaction honeypot based on the Modbus industrial protocol. The honeypot implements a complete Modbus protocol service and uses the simulated data generated by the codec to interact with attackers in real time to enhance the honeypot's deception ability. (3) The honeypot solution proposed in this application can complete long-term simulation of the equipment using a small amount of data without communicating with the real industrial equipment, and has captured more malicious traffic in actual deployment. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 It is a schematic diagram of an industrial honeypot high-interaction method based on an encoder and a decoder according to Embodiment 1 of the present invention; Figure 2 is a diagram of a codec model of embodiment 1 of the present invention; Figure 3 This is a long-term simulation effect diagram of Example 1 of the present invention; Figure 4 This is a comparison chart of honeypot session lengths in Example 1 of the present invention. DETAILED DESCRIPTION

[0020] The present invention is further described in detail below in conjunction with the accompanying drawings.

[0021] Example 1 Reference Figure 1 , an industrial honeypot high-interaction method based on an encoder and a decoder of this embodiment includes: Step 1: This embodiment uses the SWAT water treatment data set to comprehensively evaluate the method proposed in the present invention. The data set records the sampling values ​​of different sensors in the water treatment process within 7 days, and the sampling interval is minutes. First, we select sensor data from different stages in the SWAT data set, namely LIT101 (water tank sensor), AIT203 (sodium hypochlorite concentration sensor), LIT301 (ultrafiltration device water tank sensor), and LIT401 (reverse osmosis water tank sensor). All sensor values ​​will be stored in a logic controller using the Modbus communication protocol, and each value is stored by two consecutive registers. The amount of data for each sensor is 6840. In the encoder-decoder training stage, we use 50% of the data for training and 50% of the data for testing.

[0022] Step 2: During the model training phase, the register values ​​of industrial equipment over a period of time are , t=200 where Represents the value of the register at the i-th moment, and trains the encoder-decoder model to generate the simulated value for the next period of time , where T=50 is the number of time steps for a single simulation of the model. The encoder-decoder model is as follows Figure 2 As shown, the specific steps are: (1) Data Enter the encoder module and get its encoder hidden layer state: in represents the encoder hidden layer activation function, which consists of a bidirectional LSTM neural network with 64 neurons. Represents the hidden layer state of the encoder at time i.

[0023] (2) Calculate the hidden layer state of the decoder at time m: in represents the encoder hidden layer activation function, which consists of an LSTM neural network with 64 neurons. represents the hidden state of the decoder at time m, and . represents the output value of the model at the previous moment, and .

[0024] (3) Input the encoder and decoder hidden layer states at all times into the attention module to obtain the context vector The calculation method is as follows: in represents the hidden state of the decoder at time m, and , Used to measure the degree of correlation between the hidden layer states of the encoder and decoder; Represents the weights of the encoder hidden layer states. The role of the softmax function is to ensure that the sum of all weights is 1.

[0025] (4) The decoder hidden layer state and context vector Input the fully connected layer to get the output value of the model at this moment. The calculation method is as follows: in Represents the fully connected layer activation function.

[0026] (5) Repeat (2)-(4) until the time step number T for a single simulation of the model reaches 50.

[0027] Step 3: The loss function is calculated for the output of the encoder-decoder model. The steps are as follows: (1) The loss function of the model output at each time point is calculated. The present invention proposes a new Huber quantile loss function, whose calculation formula is as follows: in represents the true value at time t, represents the target quantile, express The model output at the moment The value of the quantile indicates that when q takes different values, the model will give different outputs. The values ​​of q in the present invention are 0.1, 0.5 and 0.9, that is, . is the Huber function. When the error between the true value and the model output value is Less than threshold =0.05, is the L2 loss function, otherwise, is the L1 loss function. The main function is to ensure the single point loss function exist The function is differentiable at points, which enables it to be used for gradient descent training of neural networks.

[0028] (2) Calculate the average loss function of the model as follows: Where Q=3 is the number of quantiles, which means that the model will produce 3 output values ​​at each moment.

[0029] Step 4: Repeat steps 1 and 2 until the maximum number of training rounds R is reached, then stop training the model and save the model parameters.

[0030] Step 5: In the testing phase, the model parameters saved in step 3 are used to generate long-term simulation data. The specific steps are as follows: (1) Test register data Input the saved encoder-decoder model to get the single simulation result of the model ,in .

[0031] (2) Select appropriate simulation values ​​for output according to the following data selection rules: Assume that the reasonable range of register values ​​is ,in is the maximum value of the register, When using the model to generate simulation data, the present invention will first select the quantile value of q=0.5 as the final output value, that is, .when When As the final output value. When , it means that the model can no longer perform accurate simulation due to error accumulation, and the generation of simulation data is stopped.

[0032] (3) Fill the simulated value selected in (2) back to the end of the test data in (1), and shift the test data back by T = 50 bits.

[0033] (4) Calculate the number of cycles N = L / T required to generate all simulation data.

[0034] (5) Loop (1) to (3) until the maximum number of loops N is reached or the test data has a null value and stops generating simulation data.

[0035] Step 6: All generated simulation data Write the register value configuration file in chronological order. , according to the IEEE745 data conversion rules, it is converted into a 4-byte hexadecimal value and written into two registers at consecutive addresses according to the timestamp i. For the value of each register, you can use Indexing is performed, where m is the register address. The present invention uses registers with addresses 1-8 for storage of four sensors.

[0036] Step 7: The honeypot responds to the attacker's request based on the register value configuration file generated in step 4. The specific steps are as follows: (1) Calculate the timestamp of the Modbus request packet sent by the attacker ,in The unit is minutes. is the system time when the current message arrives, The arrival time of the first Modbus request data packet. Represents rounding the value down.

[0037] (2) The honeypot parses the Modbus request data packet sent by the attacker according to the protocol specification. The parsed fields include transaction identifier, protocol identifier, length, unit identifier, function code, starting address, quantity and register value.

[0038] (3) The honeypot generates a response message to the attacker according to the following rules: When the honeypot receives the read register function code, the honeypot takes the corresponding register value from the register value configuration file. , encapsulate it into the data area of ​​the Modbus response data packet. is the starting address obtained by protocol analysis, The other fields of the response packet will be encapsulated according to the protocol specification.

[0039] When the honeypot receives the register write function code, the honeypot extracts the register value to be written according to the data packet parsing result. , and use Replace the value of the corresponding timestamp in the register value configuration file. Then encapsulate the response packet according to the protocol specification.

[0040] When the request received by the honeypot does not belong to the read or write register function, the honeypot will respond with an illegal function code (0x01) according to the protocol specification.

[0041] When the number of registers to be read or written exceeds the address range, , the honeypot will give an address out of limit (0x02) response according to the protocol specification.

[0042] Experimental verification: In order to verify the effectiveness of the method proposed in the present invention, we first compared the encoder-decoder model proposed in the present invention with the LSTM-Autoconder model and Seq2seq sequence generation model commonly used in numerical simulation through a set of experiments on the test set. This experiment uses RMSE (root mean square error) and DTW (dynamic time warping) distance for model evaluation. The smaller the RMSE, the smaller the simulation error, and the smaller the DTW distance, the more similar the curve of the simulated data is to the true value curve. The experimental results are shown in Table 1 as a test set comparison experiment table.

[0043] Table 1 Experimental results show that the proposed encoder-decoder model achieves the best simulation effect on each sensor in the test set. In addition, due to the addition of Huber quantile loss, the proposed model does not produce unreasonable outliers like other baseline methods, which makes the honeypot look more like a real industrial device.

[0044] In addition, we use the trained model to generate simulated data for the next month to evaluate the long-term simulation ability of the model. Then we count the data distribution of the training set and the simulated data. The experimental results are as follows: Figure 3 Show.

[0045] Since industrial sensors have quasi-periodic characteristics, the simulated data should have a data distribution similar to that of the training set. Figure 3 It can be seen that the simulated data distribution of the encoder-decoder model proposed in the present invention on the three sensors LIT101, LIT301 and LIT401 is basically the same as the training set, which shows that the extension of the simulation time does not have much impact on the output of the model. The data distribution of the AIT203 sensor has a small difference because the system did not reach a stable state on the first day of the training set. In addition, the standard deviations of the four sensors are 0.4, 0.46, 0.18 and 0.01, respectively, and the mean values ​​are 0.7, 2.74, 2.69 and 0.45, which shows that the honeypot using the encoder-decoder model can generate response messages for specific scenarios during the interaction with the attacker and ensure that the honeypot can be online for a long time.

[0046] In order to evaluate the honeypot's ability to deceive attackers, we use session length to count the data captured by the honeypot. The longer the session length, the more times the attacker interacts with the honeypot in a period of time, which also means that the honeypot's deception ability is higher.

[0047] We deployed the developed honeypot on a cloud server and collected data for 6 months. At the same time, this experiment also deployed an ordinary honeypot based on the template interaction method as a comparative experiment. The experimental results show that the industrial honeypot proposed in this invention received 7183 attacks from 341 IPs, while the ordinary honeypot only received 4975 attacks from 215 IPs. Figure 4 The session length ratios of the two honeypots are shown.

[0048] In ordinary honeypots, the number of interactions between attackers and honeypots is mostly concentrated in 1-2 rounds. However, the honeypot proposed by the present invention has a longer number of interactions, especially the proportion of interactions exceeding 7 times is significantly higher than that of ordinary honeypots. This shows that adding a model for register values ​​in the honeypot can effectively increase the attractiveness of the honeypot to attackers.

[0049] Example 2 This embodiment provides an industrial honeypot high-interaction system based on an encoder and a decoder, including: A data acquisition module is configured to acquire water treatment data; The model training module is configured to train the encoder-decoder model using the acquired water treatment data, wherein a loss function is calculated for the output of the encoder-decoder model; the model training is stopped after a maximum number of training rounds R is reached, and the model parameters are saved; The data generation module is configured to generate long-term simulation data from the saved model parameters and write the data into a register value configuration file in chronological order; The response module is configured to respond to the attacker's request using the honeypot according to the generated register value profile.

[0050] A computer-readable storage medium stores a plurality of instructions, wherein the instructions are suitable for being loaded and executed by a processor of a terminal device, for example, an industrial honeypot high-interaction method based on an encoder and a decoder.

[0051] A terminal device includes a processor and a computer-readable storage medium, wherein the processor is used to implement various instructions; the computer-readable storage medium is used to store multiple instructions, wherein the instructions are suitable for being loaded by the processor and executing the industrial honeypot high-interaction method based on an encoder and a decoder.

[0052] The above are all preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention. Therefore, any equivalent changes made based on the structure, shape, and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. An industrial honeypot high-interaction method based on encoder and decoder, characterized in that: include: Obtain water treatment data; The encoder-decoder model is trained using the acquired water treatment data, wherein a loss function is calculated for the output of the encoder-decoder model; the model training is stopped after reaching a maximum number of training rounds R, and the model parameters are saved; Generate long-term simulation data with the saved model parameters and write them into the register value configuration file in chronological order; The honeypot is used to respond to the attacker's request based on the generated register value profile.

2. According to claim 1, an industrial honeypot high-interaction method based on an encoder and a decoder is characterized in that: The obtaining of water treatment data includes obtaining sampling values ​​of different sensors in the water treatment process within 7 days, with a sampling interval of minutes, specifically including LIT101 water tank sensor data, AIT203 sodium hypochlorite concentration sensor data, LIT301 ultrafiltration device water tank sensor data and LIT401 reverse osmosis water tank sensor data.

3. The industrial honeypot high-interaction method based on encoder and decoder according to claim 2 is characterized in that: The method of using the acquired water treatment data to train the encoder-decoder model includes inputting the data into the encoder of the model to obtain the hidden layer state of the encoder, and then calculating the hidden layer state of the decoder at a certain moment, inputting the hidden layer states of the encoder and decoder at all moments into the attention module to obtain the context vector, and inputting the hidden layer state of the decoder and the context vector into the fully connected layer to obtain the output value of the model at this moment.

4. The high-interaction method of industrial honeypot based on encoder and decoder according to claim 3 is characterized in that: The loss function is calculated for the output of the encoder-decoder model, the Huber quantile loss function is calculated for the model output at each time point, and then the average loss function of the model is calculated. The Huber quantile loss function is expressed as: in represents the true value at time t, represents the target quantile, express The model output at the moment The values ​​of quantile, q, are 0.1, 0.5, and 0.9 respectively. is the Huber function. When the error between the true value and the model output value is Less than threshold =0.05, is the L2 loss function, otherwise, is the L1 loss function; Used to ensure single point loss function exist The function is differentiable at points, which enables it to be used for gradient descent training of neural networks.

5. The industrial honeypot high-interaction method based on encoder and decoder according to claim 4 is characterized in that: The method generates long-term simulation data using the saved model parameters, including inputting the test register data as test data into the saved encoder-decoder model, obtaining a single simulation result of the model, setting a reasonable range of register values, selecting rules to select simulation values ​​for output and backfilling them to the end of the test data, and shifting the test data back by T=50 bits, calculating the number of cycles required to generate all the simulation data, and stopping generating simulation data until the maximum number of cycles N is reached or the test data has a null value.

6. The high-interaction method of industrial honeypot based on encoder and decoder according to claim 5, characterized in that: The step of writing into the register value configuration file in chronological order includes writing all generated simulation data into the register value configuration file in chronological order, converting each decimal simulation data into a 4-byte hexadecimal value according to the IEEE745 data conversion rules, and writing it into registers of two consecutive addresses according to the timestamp.

7. The industrial honeypot high-interaction method based on encoder and decoder according to claim 6 is characterized in that: The method uses the honeypot to respond to the attacker's request according to the generated register value configuration file, including calculating the timestamp of the Modbus request data packet sent by the attacker, and using the honeypot to parse the Modbus request data packet sent by the attacker according to the protocol specification, and the parsed fields include transaction identifier, protocol identifier, length, unit identifier, function code, starting address, quantity and register value; the honeypot generates a response message to the attacker according to the set rules.

8. An industrial honeypot high-interaction system based on encoder and decoder, characterized in that: include: A data acquisition module is configured to acquire water treatment data; The model training module is configured to train the encoder-decoder model using the acquired water treatment data, wherein a loss function is calculated for the output of the encoder-decoder model; the model training is stopped after a maximum number of training rounds R is reached, and the model parameters are saved; The data generation module is configured to generate long-term simulation data from the saved model parameters and write the data into a register value configuration file in chronological order; The response module is configured to respond to the attacker's request using the honeypot according to the generated register value profile.

9. A computer-readable storage medium storing a plurality of instructions, characterized in that: The instructions are suitable for being loaded by a processor of a terminal device and executing the method according to claim 1 .

10. A terminal device, comprising a processor and a computer-readable storage medium, wherein the processor is used to implement each instruction; and the computer-readable storage medium is used to store multiple instructions, characterized in that: The instructions are suitable for being loaded by a processor and executing the method as claimed in claim 1 .

Images