Cloud honeypot camouflage implementation method and device, computer equipment and storage medium

Abstract

The invention relates to a cloud honeypot camouflage implementation method and device, computer equipment, a storage medium and a computer program product. The method comprises the steps of obtaining a target probe bound with a cloud honeypot, performing access monitoring based on the target probe to obtain the target probe bound with the cloud honeypot, and performing access monitoring based on the target probe; under the condition that an access object is monitored through the target probe, acquiring a command input by the access object; the original execution logic of the command is updated based on the cloud honeypot to obtain updated execution logic, and the updated execution logic is used for enabling an execution result obtained by executing the command to be the same as an execution result obtained by accessing a real server environment by the access object; and executing the command according to the update execution logic to obtain an execution result, and feeding back the execution result to the access object. By adopting the method, the honeypot can be prevented from being identified by the access object, and the effect of disguising the access object is achieved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, apparatus, computer device, storage medium and computer program product for implementing cloud honeypot camouflage. Background Art

[0002] Honeypot is a technology that uses bait hosts, network services or information to lure attackers into attacking them. This allows the attackers to capture and analyze the attack behavior, understand the tools and methods used by the attackers, and infer the attack intentions and motives, allowing defenders to clearly understand the security threats they face.

[0003] However, when the honeypot is deployed in a container, it is easy for an attacker to detect the honeypot after entering the container, so that the attacker's stay in the honeypot is very short. The honeypot cannot capture more of the attacker's attack behaviors and methods, resulting in poor application effects of the deployed honeypot. Summary of the invention

[0004] Based on this, it is necessary to provide a cloud honeypot camouflage implementation method, device, computer equipment, computer-readable storage medium and computer program product that can improve the application effect of the honeypot in response to the above technical problems.

[0005] In a first aspect, the present application provides a method for implementing cloud honeypot camouflage. The method comprises:

[0006] Obtain the target probe bound to the cloud honeypot, and perform access monitoring based on the target probe. Obtain the target probe bound to the cloud honeypot, and perform access monitoring based on the target probe.

[0007] When the target probe detects the access object, obtaining a command input by the access object;

[0008] The original execution logic of the command is updated based on the cloud honeypot to obtain an updated execution logic, wherein the updated execution logic is used to make the execution result obtained by executing the command the same as the execution result obtained by the access object accessing the real server environment;

[0009] The command is executed according to the update execution logic to obtain an execution result, and the execution result is fed back to the access object.

[0010] In a second aspect, the present application also provides a cloud honeypot camouflage implementation device. The device includes:

[0011] An access monitoring module is used to obtain a target probe bound to a cloud honeypot, and perform access monitoring based on the target probe. The target probe bound to the cloud honeypot is obtained, and access monitoring is performed based on the target probe.

[0012] A command acquisition module, used for acquiring a command input by an access object when an access object is detected by the target probe;

[0013] A command update module, used to update the original execution logic of the command based on the cloud honeypot to obtain an updated execution logic, wherein the updated execution logic is used to make the execution result obtained by executing the command the same as the execution result obtained by the access object accessing the real server environment;

[0014] An execution result feedback module is used to execute the command according to the update execution logic, obtain the execution result, and feed back the execution result to the access object.

[0015] In a third aspect, the present application further provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0016] Obtain the target probe bound to the cloud honeypot, and perform access monitoring based on the target probe. Obtain the target probe bound to the cloud honeypot, and perform access monitoring based on the target probe.

[0017] When the target probe detects the access object, obtaining a command input by the access object;

[0018] The original execution logic of the command is updated based on the cloud honeypot to obtain an updated execution logic, wherein the updated execution logic is used to make the execution result obtained by executing the command the same as the execution result obtained by the access object accessing the real server environment;

[0019] The command is executed according to the update execution logic to obtain an execution result, and the execution result is fed back to the access object.

[0020] In a fourth aspect, the present application further provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0021] Obtain the target probe bound to the cloud honeypot, and perform access monitoring based on the target probe. Obtain the target probe bound to the cloud honeypot, and perform access monitoring based on the target probe.

[0022] When the target probe detects the access object, obtaining a command input by the access object;

[0023] The original execution logic of the command is updated based on the cloud honeypot to obtain an updated execution logic, wherein the updated execution logic is used to make the execution result obtained by executing the command the same as the execution result obtained by the access object accessing the real server environment;

[0024] The command is executed according to the update execution logic to obtain an execution result, and the execution result is fed back to the access object.

[0025] In a fifth aspect, the present application further provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0026] Obtain the target probe bound to the cloud honeypot, and perform access monitoring based on the target probe. Obtain the target probe bound to the cloud honeypot, and perform access monitoring based on the target probe.

[0027] When the target probe detects the access object, obtaining a command input by the access object;

[0028] The original execution logic of the command is updated based on the cloud honeypot to obtain an updated execution logic, wherein the updated execution logic is used to make the execution result obtained by executing the command the same as the execution result obtained by the access object accessing the real server environment;

[0029] The command is executed according to the update execution logic to obtain an execution result, and the execution result is fed back to the access object.

[0030] The cloud honeypot camouflage implementation method, device, computer equipment, storage medium and computer program product can monitor the access object through the target probe by acquiring a target probe that has a binding relationship with the cloud honeypot, and introduce the access object into the cloud honeypot to collect the access object's behavior and means when accessing the cloud honeypot. When the access object wants to identify whether to enter the honeypot through the execution result of the command, the original execution logic of the command is updated to obtain the updated execution logic, so that the execution result obtained by executing the command is the same as the execution result obtained by the access object accessing the real server environment. Based on the execution result obtained by executing the command according to the updated execution logic, the effect of camouflaging and deceiving the access object can be achieved, and the honeypot can be prevented from being identified by the access object, so that the attacker as the access object can stay in the honeypot for a long time, and more attack behaviors and means of the access object can be captured through the honeypot, thereby improving the application effect of the deployed honeypot. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 This is an application environment diagram of a method for implementing cloud honeypot camouflage in an embodiment;

[0032] Figure 2 It is a flowchart of a method for implementing cloud honeypot camouflage in one embodiment;

[0033] Figure 3 A schematic diagram of the interaction between various objects in the process of implementing physical resource camouflage in one embodiment;

[0034] Figure 4 A schematic diagram of a process for implementing physical resource camouflage in one embodiment;

[0035] Figure 5 A schematic diagram of the interaction between various objects in the process of implementing service process information masquerading in one embodiment;

[0036] Figure 6 A schematic diagram of a process for implementing service process camouflage in one embodiment;

[0037] Figure 7 A schematic diagram of the execution result of a cloud honeypot executing a timed refresh command through a server in one embodiment;

[0038] Figure 8 A flowchart of a method for implementing cloud honeypot camouflage in another embodiment;

[0039] Fig. 9 A schematic diagram of a flow chart for configuring a probe and a honeypot in one embodiment;

[0040] Fig.10 It is a structural block diagram of a cloud honeypot camouflage implementation device in one embodiment;

[0041] Fig.11 is an internal structure diagram of a computer device in one embodiment;

[0042] Fig.12 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0044] Honeypot: It is a technology that uses bait hosts, network services or information to lure attackers into attacking them. This allows the attackers to capture and analyze the attack behavior, understand the tools and methods used by the attackers, and infer the attack intentions and motives, so that defenders can clearly understand the security threats they face.

[0045] Specifically, honeypots are divided into cloud honeypots and non-cloud honeypots. The offline camouflage implementation of non-cloud honeypots is relatively simple, and users can also configure the honeypot machine separately to achieve the camouflage effect, and it does not require network camouflage or physical resource camouflage. When cloud honeypots provide SAAS delivery, manufacturers are required to provide unified and automated camouflage. In traditional honeypot implementations, users are required to configure and construct camouflaged data themselves. In other words, traditional honeypots require honeypot manufacturers and maintenance personnel to "clone" camouflaged data for customers' existing services and put it on the honeypot, and it is difficult to construct a large number of inputs and outputs on the honeypot service, which is relatively high in terms of both machine costs and labor costs.

[0046] Honeypot disguises the real server: it is a real server. For example, the nginx disguised server is a real nginx server, and there will always be http and https request and response traffic, which is exactly the same as the real nginx server. The real data of the server is used in the honeypot to achieve disguise.

[0047] Probe: The forms in which honeypot services are exposed to the outside world are commonly: public IP (Internet Protocol), intranet IP, and domain name.

[0048] Mother machine: the host machine where the honeypot docker (container) runs;

[0049] Host agent: A program that deploys honeypots, deploys probes, collects logs, uploads logs, and executes or forwards remote commands on the host.

[0050] At present, in order to collect information and samples of attackers' attack behaviors, various types of honeypots have emerged to target various types of network threats. Specifically, a honeypot is a virtual system or network that is used to lure attackers. It can find, save and analyze the traces left by attackers on the computer system, and grasp their whereabouts, so as to understand the latest technologies and working ideas used by attackers. By obtaining this information, we will better understand the threats encountered by the system and think about how to prevent these threats, so as to gain the greatest initiative in the war with attackers. At present, honeypots, as an emerging network defense technology, can not only actively trap attackers from the external network, but also detect hosts that spread viruses horizontally in advance in the enterprise intranet. In addition, they can collect important information about attackers and have a good active security confrontation effect.

[0051] Honeypots lure attackers into launching network attacks by deliberately constructing security loopholes. For example, they leave various loopholes and weak passwords to lure attackers into attacking. The common feature of honeypots is that they are essentially virtual machines. The attack and defense between the defender and the attacker is a process of mutual development and promotion. After the emergence of honeypots, in general, in order to avoid falling into the honeypot trap set by the defender and not letting the other party know their attack path and payload, the attacker will first determine whether the current target or object to be attacked is a honeypot, or in other words, whether the object to be attacked is a virtual machine. If it is a honeypot or a virtual machine, in order to reduce losses, the attacker will generally choose to give up continuing the attack and actively escape. If it is a physical machine, the physical machine is valuable for them to attack, so they will choose to continue the attack.

[0052] In response to the problem that current attackers choose to actively escape, causing the honeypot trapping intention to fail, the embodiment of the present application provides a technical solution for implementing honeypot camouflage. When the attacker attempts to verify whether it is a honeypot or a virtual machine by obtaining a command, after receiving the command, the honeypot tampers with the original execution logic of the command and returns the command execution result that is the same as the real environment of the server to the attacker, so as to confuse the attacker into making a wrong judgment and causing him to continue to carry out network attacks. This can prevent the attacker from seeing through the trap to a certain extent, thereby facilitating the increase of the probability of successfully trapping the attacker.

[0053] The cloud honeypot camouflage implementation method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the honeypot 102 is essentially a virtual machine. The honeypot 102 is deployed in a container and can be run in the host machine 104. Each type of honeypot 102 corresponds to a real server 106, which is used to provide targeted service access data. The host machine 104 and the real server 106 are connected through a network. In a specific implementation, the host machine 104 responds to the configuration operation of the defender, creates a cloud honeypot 102 and a target probe, and establishes a binding relationship between the cloud honeypot and the target probe. The cloud honeypot 102 performs access monitoring based on the target probe, and obtains the command input by the access object when the access object 108 is detected through the target probe; the cloud honeypot 102 updates the original execution logic of the command based on the cloud honeypot to obtain the updated execution logic, and the updated execution logic is used to make the execution result obtained by executing the command the same as the execution result obtained by the access object accessing the real server environment, and then executes the command according to the updated execution logic to obtain the execution result, and feeds the execution result back to the access object 108. When the access object 108 is an attacker, the above processing can utilize the disguised execution results to confuse the attacker into making a wrong judgment and causing him to continue to carry out the network attack, thereby preventing the attacker from seeing through the entrapment trap to a certain extent, thereby facilitating increasing the probability of successfully entrapping the attacker.

[0054] Among them, the defender can perform configuration operations based on the terminal, and the access object can access services based on the terminal. The terminal can be, but is not limited to, various desktop computers, laptops, smart phones, tablets, IoT devices and portable wearable devices. IoT devices can be smart speakers, smart TVs, smart air conditioners, smart car devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The host and server can be implemented as independent servers or server clusters consisting of multiple servers.

[0055] In one embodiment, Figure 2 As shown, a cloud honeypot camouflage implementation method is provided, and the method is applied to Figure 1 Take the cloud honeypot in the example as an example, including the following steps:

[0056] Step 202: Obtain a target probe bound to the cloud honeypot, and perform access monitoring based on the target probe.

[0057] Among them, the cloud honeypot and the target probe are created and bound by responding to the configuration operation of the defender. The defender is relative to the attacker. The defender's server is generally the attacker's network attack target. The defender attempts to attract the attacker's attack access by creating a honeypot, so that the attacker's access object becomes the deployed honeypot. The defender attracts the attacker's attack access to the honeypot. On the one hand, it can avoid the attacker's direct attack on the defender's server. On the other hand, it can capture the attacker's attack behavior and means based on the honeypot, so as to formulate measures to defend against the attack behavior and means, strengthen the protection of the defender's server, and improve security.

[0058] The configuration operation of the defender refers to the creation and binding operation of cloud honeypots and probes triggered by the defender. Specifically, the defender can choose to create probe types and honeypot services through the WEB console. Among them, the probe belongs to network resources and is the form of external exposure of the honeypot service. The more common probes are public network IP, intranet IP, domain name, etc. Honeypot is a service, which can be a virtual machine service. Cloud honeypots are deployed in containers, and the host provides a running environment for the container where the cloud honeypot is deployed. The number of cloud honeypots created by the defender can be one or more, and the number of probes can also be one or more. When establishing the association between cloud honeypots and probes, the same cloud honeypot can be bound to multiple probes, and the same probe can also be bound to multiple cloud honeypots.

[0059] The target probe can be used as bait to attract attackers on the defender side. The access object accessed through the target probe is likely to be an attacker targeting the defender. By establishing a binding relationship between the target probe and the cloud honeypot, the host can divert the access object accessed through the target probe to the cloud honeypot so that the cloud honeypot can analyze the behavior or means of the access object to determine whether the access object is an attacker on the defender side. If so, the defender can further analyze the attack behavior and means of the access object during the access process and formulate corresponding defense measures. By binding the honeypot and the probe for diversion, the efficiency and accuracy of monitoring the access object can be improved.

[0060] A cloud honeypot is essentially a virtual machine that runs on a host machine. It runs on a different system than the host machine. The host machine is a real physical machine and is generally the target or object of the attacker. The virtual machine and the real physical machine can be configured to be isolated from each other or to interact with each other. A cloud honeypot is a honeypot created in response to the configuration operation of the defender and running in a cloud server environment.

[0061] Step 204: When the access object is detected by the target probe, a command input by the access object is obtained.

[0062] The access object refers to the party that accesses the cloud honeypot through the target probe. The attacker corresponding to the defender is the access object. When he suspects that he has entered the honeypot, he may query the current access environment through the system query command.

[0063] The commands input by the access object may specifically include commands for viewing network resource information, commands for viewing physical resource information, commands for viewing service process information, etc.

[0064] The commands for viewing network resource information may specifically include ip addr command, ip route command, ifconfig command, hostname command, etc. In normal service access, when the server receives the command for viewing network resource information, it will feed back the actual network resource information queried by the command to the query terminal. For honeypot access, since the IP that the attacker sees by entering the command for viewing network resource information is the container IP corresponding to the container where the honeypot is deployed, rather than the public network IP or intranet IP corresponding to the probe, the attacker, as the access target, can immediately discover that the access is to a honeypot.

[0065] The commands for viewing physical resource information may include top command, ps command, pstree command, vmstat command, dstat command, uptime command, cat / proc / pid / * command, mpstat command, free command, etc. In normal service access, when the server receives the command to view physical resource information, it will feedback the real physical resource information of the server to the query terminal. However, for cloud honeypot access, since the cloud honeypot generally occupies fewer physical resources and is in a docker environment, the attacker can quickly find that the target of access is the honeypot through the scarce physical resources returned.

[0066] The normal operation of the process is the best indicator of whether the current service is a real service. If the access target sees that the process on the honeypot is running normally, the operation not only occupies a large part of the CPU and memory, but also is accompanied by a large amount of input and output, the access target will easily regard the cloud honeypot as a real service. On the contrary, it is easy to identify that the access target is a honeypot. The commands for viewing service process information include top command, ps command, pstree command, vmstat command, dstat command, uptime command, cat / proc / pid / * command, mpstat command, free command, etc.

[0067] Step 206, based on the cloud honeypot, the original execution logic of the command is updated to obtain an updated execution logic, and the updated execution logic is used to make the execution result obtained by executing the command the same as the execution result obtained by accessing the real server environment of the access object.

[0068] The original execution logic of the command refers to the logic executed according to the system-defined command execution method. For example, the original execution logic corresponding to the command to view network resource information is to return the network resource information of the content currently accessed by the access object, such as the container address of the container where the honeypot is located. For another example, the original execution logic corresponding to the command to view physical resource information is to return the physical resource information of the content currently accessed by the access object, such as the physical resources of the honeypot virtual machine.

[0069] The update execution logic is the execution logic pre-configured for the input command, so that the execution result obtained by executing the command is different from the result obtained by executing according to the original execution logic, but is the same as the execution result obtained by the access object accessing the real server environment. The update execution logic can be pre-configured, and when the command input by the access object is obtained, the execution logic is updated to achieve the replacement of the execution result of the command, so as to achieve the effect of disguising the honeypot and preventing the honeypot from being identified by the access object.

[0070] Different types of command updates have different execution logics, and different types of execution logics can also have different execution objects. For example, for a command that can directly provide a simple result, the execution object of its updated execution logic can be a honeypot, that is, a virtual machine. For another example, for a command that needs to provide a complex result, the execution object of its updated execution logic can be a real server, such as the host machine running the honeypot, or a real server of the same type as the honeypot.

[0071] The real server environment is the environment relative to the honeypot environment. The honeypot environment is a virtual environment, and the real server environment is the real environment when directly accessing the server. Compared with the honeypot environment, the real server environment has different types of access addresses, different physical resources, different process information, etc. For example, the access address of the real server environment is the server address, and the access address of the honeypot environment is the honeypot container address.

[0072] In a specific application, after obtaining the command input by the access object, the cloud honeypot determines the original execution logic of the command, and based on the original execution logic, determines whether the command is a command that easily exposes the properties of the honeypot. If not, the command can be executed directly. If so, the original execution logic of the command is updated to obtain the updated execution logic, so that the execution result obtained by executing the command is the same as the execution result obtained by the access object accessing the real server environment, thereby achieving the effect of disguising the honeypot.

[0073] Furthermore, based on the original execution logic, the implementation method of determining whether the command is a command that is likely to expose the honeypot attribute can be specifically to determine the correlation between the execution result and the honeypot attribute based on the original execution logic of each command in advance, and to determine the command whose execution result is correlated with the honeypot attribute as a command that is likely to expose the honeypot attribute, and to construct a command set based on the command that is likely to expose the honeypot attribute. When the command input by the access object is obtained, the command is first matched with each command in the command set, and if the command exists in the command set, the command is determined to be a command that needs to be updated in the execution logic.

[0074] Step 208: execute the command according to the update execution logic, obtain the execution result, and feed back the execution result to the access object.

[0075] After updating the original execution logic of the command and obtaining the updated execution logic, the cloud honeypot can first determine the command execution object, and then execute the command according to the updated execution logic by controlling the command execution object to obtain the execution result of the command, so as to obtain the same execution result as the access object accessing the real server environment. By feeding back the same execution result as accessing the real server environment to the access object, when the access object is an attacker, it can make a wrong judgment, so that the attacker has no way of knowing or mistakenly believes that it is the actual host environment, and thus normally implements the attack behavior to avoid the occurrence of active escape, thereby facilitating the success of trapping the attacker's intention to disguise the honeypot and achieve the effect of deceiving the access object.

[0076] The above-mentioned cloud honeypot disguise implementation method obtains a target probe that has a binding relationship with the cloud honeypot, which can monitor the access object through the target probe and introduce the access object into the cloud honeypot to collect the access object's behavior and means when accessing the cloud honeypot. When the access object wants to identify whether to enter the honeypot through the execution result of the command, the original execution logic of the command is updated to obtain the updated execution logic, so that the execution result obtained by executing the command is the same as the execution result obtained by the access object accessing the real server environment. Based on the execution result obtained by executing the command according to the updated execution logic, it is possible to achieve disguised deception of the access object and prevent the honeypot from being identified by the access object, so that the attacker as the access object can stay in the honeypot for a long time, and more attack behaviors and means of the access object can be captured through the honeypot, thereby improving the application effect of the deployed honeypot.

[0077] In some embodiments, the original execution logic of the command is updated based on the cloud honeypot to obtain the updated execution logic, including:

[0078] Based on the cloud honeypot, the access data type identification and analysis of the command is performed to determine the execution object of the command. The execution object is used to provide access data that conforms to the access data type of the command; based on the execution logic defined in the execution object, the original execution logic of the command is updated to obtain the updated execution logic.

[0079] Among them, access data type identification and analysis refers to determining the data type of the data required to be fed back when executing the command. The access data type specifically includes network resource data, physical resource data, service process data, etc. Different access data types can be configured with different data providers, that is, the execution objects of the command.

[0080] For example, the data provider of network resource data can be configured as a cloud honeypot, the data provider of physical resource data can be configured as the host machine corresponding to the cloud honeypot, and the data provider of service process data can be configured as a real server matching the honeypot type of the cloud honeypot, etc.

[0081] Based on the cloud honeypot, the access data type identification and analysis of the command is performed to determine the access data type of the command, and the provider of the data of the access data type is determined as the execution object of the command.

[0082] When updating the initial execution logic of a command, the execution logic of different execution objects is updated in different ways. Specifically, it can be distinguished based on whether remote execution is required. For example, for commands that do not require remote execution, that is, commands that can be directly executed by the cloud honeypot, the loading content of the updated command can be directly updated to load the specified content when the command is executed. For another example, for commands that need to be executed remotely, the execution can be updated to the sending of commands and the receiving of results on the cloud honeypot side. In the remote execution object that executes the command, the command is executed directly according to the original execution logic, that is, the updated execution logic includes the original execution logic of the command by the execution object.

[0083] In this embodiment, by performing access data type identification and analysis on the command and determining the execution object of the command, the execution of commands with different access data types can be achieved through different execution objects, thereby obtaining the execution results of the corresponding environment. This can avoid the exposure of the honeypot due to direct execution of commands by the cloud honeypot, which may cause the attacker to actively escape, and improve the application effect of the honeypot in capturing the attacker's attack behavior and means.

[0084] In some embodiments, when the command is a network address query command, the execution object is a cloud honeypot. Further, based on the execution logic defined in the execution object, the original execution logic of the command is updated to obtain the updated execution logic, including:

[0085] Based on the address of the target probe, the honeypot address camouflage logic of the cloud honeypot is determined; the original execution logic of the command is replaced by the honeypot address camouflage logic to obtain the updated execution logic, so that when the cloud honeypot executes the network address query command, the address of the target probe is obtained.

[0086] Among them, the address of the target probe is the address published by the access object. The access object accesses through the address of the target probe, and the target probe uses the binding relationship with the cloud honeypot to guide the access object to the cloud honeypot.

[0087] When the access object performs a network address query through a network address query command, the cloud honeypot obtains the network address query command and determines the honeypot address camouflage logic of the cloud honeypot based on the address of the target probe. The honeypot address camouflage logic is used to make the result obtained when executing the network address query command not the container address of the cloud honeypot, but the address of the target probe. The cloud honeypot uses the honeypot address camouflage logic to replace the original execution logic of the command to obtain the updated execution logic, so that the cloud honeypot executes the network address query command according to the updated execution logic, so that the address obtained by executing the network address query command is the address of the target probe.

[0088] In a specific application, after the target probe is bound to the cloud honeypot, the host will automatically generate network camouflage information, send the target probe's IP address (public IP or intranet IP) and MAC address to the cloud honeypot, and load it into the cloud honeypot's disguised and tampered system command module. The attacker invades the cloud honeypot through the target probe and uses commands such as ip addr, ip route, ifconfig, and hostname to view the cloud honeypot's network information. The IP and ifconfig commands tampered by the cloud honeypot have update execution logic, which will be loaded into the target probe's MAC address and IP address and output to the access object's terminal, so that the access object finds that the accessed IP is consistent with the IP on the destination machine, and no network traction and dnat (Destination Network Address Translation) operations occur.

[0089] In this embodiment, the disguise of network resources is achieved by updating and replacing the execution logic of the system network commands, so that after the attacker attacks, he finds that the MAC, IP and other addresses of the cloud honeypot are consistent with the attack address, thereby deceiving the attacker and improving the application effect of the honeypot in capturing the attacker's attack behavior and means.

[0090] In some embodiments, based on the execution logic defined in the execution object, the original execution logic of the command is updated to obtain the updated execution logic, including:

[0091] When the execution object is a remote execution object associated with the cloud honeypot, the remote execution logic defined for the command in the remote execution object is determined; the remote execution logic is used as a part of the command execution logic, and the original execution logic of the command is updated to obtain the updated execution logic.

[0092] The remote execution object associated with the cloud honeypot may be the host machine running the cloud honeypot or a real server matching the honeypot type of the cloud honeypot. Different commands may have the same or different remote execution objects. Specifically, it may be determined based on the access data type of the command execution result. For example, when the access data type of the command execution result is physical resource information, the remote execution object may be the host machine of the cloud honeypot. When the access data type of the command execution result is service process information, the remote execution object may be a real server matching the honeypot type of the cloud honeypot.

[0093] For a remote execution object, its execution environment is the real server environment. Therefore, the remote execution logic for the command contained in the remote execution object itself can be directly used as part of the command execution logic to update the original execution logic of the command and obtain the updated execution logic. Specifically, the updated execution logic also includes the cloud honeypot's sending processing logic for the command and the receiving processing logic for the command execution result of the remote execution object.

[0094] In a specific application, when the execution object is a remote execution object associated with a cloud honeypot, the remote execution logic defined for the command in the remote execution object is determined, and the execution logic for the command in the cloud honeypot is updated to the cloud honeypot's sending processing logic for the command and the receiving processing logic for the command execution result of the remote execution object, and the remote execution logic is used as a part of the command execution logic to update the original execution logic of the command to obtain the updated execution logic. The updated execution logic includes the sending processing logic of the cloud honeypot sending the command to the remote execution object, the remote execution logic defined for the command in the remote execution object, and the receiving processing logic of the cloud honeypot obtaining the command execution result of the remote execution object.

[0095] In this embodiment, the remote execution logic defined for the command in the remote execution object is used as a part of the command execution logic, and the original execution logic for the command in the cloud honeypot is updated. Since the execution environment of the remote execution object itself is the real server environment, the access object can obtain the execution result of the real server environment through the cloud honeypot, thereby achieving the effect of disguising and deceiving the access object and preventing the honeypot from being identified by the access object.

[0096] In some embodiments, a command sharing file and an execution result sharing file are constructed between the remote execution object and the cloud honeypot. The cloud honeypot camouflage implementation method also includes:

[0097] When the execution object is a remote execution object, based on the updated execution logic, the command is written into the command sharing file so that the remote execution object executes the newly added command in the command sharing file according to the remote logic, and writes the execution result of the command into the execution result sharing file; the execution result of the command is obtained from the execution result sharing file.

[0098] The command sharing file is a file in which the cloud honeypot shares the command with the remote execution object, and the execution result sharing file is a file in which the remote execution object shares the command execution result with the cloud honeypot.

[0099] Specifically, the cloud honeypot has write permission to the command sharing file, and the remote execution object has read permission to the command sharing file. The cloud honeypot can write commands to the command sharing file, and the remote execution object can read the command from the command sharing file, thereby sharing commands from the cloud honeypot to the remote execution object.

[0100] The remote execution object has the permission to write to the execution result shared file, and the cloud honeypot has the permission to read the execution result shared file. The remote execution object can write the command execution result to the execution result shared file, and the cloud honeypot can read the command execution result from the execution result shared file, thereby sharing the command execution result from the remote execution object to the cloud honeypot.

[0101] In this embodiment, commands and command execution results are shared through shared files, so that the remote execution object can monitor the command shared files and quickly read the commands from the command shared files. It can also enable the cloud honeypot to monitor the execution result shared files and quickly read the command execution results from the execution result shared files, effectively improving data processing efficiency.

[0102] In some embodiments, the cloud honeypot camouflage implementation method also includes: when the execution object is a remote execution object, sending the command to the host machine that provides the operating environment for the container where the cloud honeypot is located; the command execution conditions of the host machine, including that the command is a security command and the access data type of the command is physical resource information; receiving the physical resource information generated and fed back by the execution command when the host machine determines that the command meets the command execution conditions of the host machine.

[0103] The host is a real server, the honeypot is deployed in a container, and the host provides a running environment for the container where the honeypot is deployed. The host is a type of remote execution object. When the host obtains a command shared by the cloud honeypot, it first determines whether the command needs to be executed by the host. The host can specifically determine whether the command needs to be executed by the host through pre-configured command execution conditions for the host.

[0104] The host machine's command execution conditions include that the command is a safe command and the type of access data of the command is physical resource information. Among them, a safe command means that the host machine is safe to execute the command and will not bring security risks to the host machine. Physical resource information can include specific information about physical resources such as the machine's CPU and memory.

[0105] When the host machine determines that the command meets the command execution conditions of the host machine, it will determine that the command needs to be executed by the host machine. Since the access data type of the command is physical resource information, the host machine can generate the physical resource information of the host machine through the command execution logic defined for the command, and feed back the physical resource information of the host machine to the cloud honeypot.

[0106] In a specific application, the host machine is used to disguise the physical resources of the honeypot. The commands and parameters entered by the attacker are transmitted to the host machine of the honeypot. After the commands are executed on the honeypot host machine, the command execution results are returned to the honeypot and output to the terminal where the access object is located. From the attacker's perspective, the honeypot outputs the files of real physical resources.

[0107] like Figure 3 As shown in the figure, the attacker, as the access object, enters a physical resource query command at the terminal accessing the cloud honeypot. The input physical resource query command has been hooked in the cloud honeypot and will be sent directly to the cloud honeypot. The cloud honeypot will perform access data type identification and analysis on the physical resource query command, determine the execution object of the command, and update the original execution logic of the command based on the execution logic defined in the execution object to obtain the updated execution logic. If the cloud honeypot further determines that the physical resource query command needs to be executed remotely, the physical resource query command and parameters are shared with the host through the specified file, so that the host can remotely execute the physical resource query command, and return the execution result of the physical resource query command to the cloud honeypot.

[0108] Specifically, Figure 4 As shown, the host agent receives the physical resource query command, parses the command and parameters again, confirms whether the command needs to be executed remotely and whether the command execution is safe. The host agent executes the update execution logic on the host, configures the same parameters, executes the physical resource query command, and obtains the execution result of the physical resource query command.

[0109] Furthermore, the host agent returns the execution result of the physical resource query command to the cloud honeypot, which is transmitted in the form of a shared file of the host through the honeypot container of the cloud honeypot and the cloud honeypot. The cloud honeypot monitors the data update of the shared file, and the command program of the execution logic is updated based on the replacement in the cloud honeypot. The command execution result returned by the host is collected from the shared file, and the command execution result is output to the terminal where the access object is located, so that the access object can obtain the physical resource information of the host through the terminal, thereby achieving the effect of deceiving the access object.

[0110] In this embodiment, the physical resource information of the host machine is shared to the cloud honeypot, so that the cloud honeypot transmits the physical resource information of the host machine back to the attacker, causing the attacker to make a wrong judgment. The attacker has no way of knowing the honeypot environment or mistakenly believes that the honeypot environment is the actual host environment, thereby carrying out the attack normally to avoid active escape, thereby facilitating the success of the attempt to entrap the attacker.

[0111] In some embodiments, the cloud honeypot camouflage implementation method further includes:

[0112] When the host determines that the command meets the server's command execution conditions, the command is sent to the server matching the cloud honeypot through the host; the service process information fed back by the server through the host is received. The service process information is generated by the server executing the command according to the defined execution logic.

[0113] When the host determines that the command does not meet the command execution condition of the host, the host may further determine whether the command meets the command execution condition of the server.

[0114] The command execution conditions of the server include that the command is a security command and the access data type of the command is service process information. Among them, the command being a security command in the command execution conditions of the server means that it is safe for the server to execute the command and will not bring security risks to the server. The service process information may include specific information such as whether the process has been running normally, the CPU and memory occupied by the operation, and the input and output of the process.

[0115] When the host determines that the command meets the server's command execution conditions, it will determine that the command needs to be executed by the server. The host can send the command from the host to the server through interaction with the server, and the server will execute the command. Since the access data type of the command is service process information, the server can generate the service process information of the server through the command execution logic defined for the command, and feed the service process information back to the host, and the host will share the process information fed back by the server to the cloud honeypot.

[0116] A real server cluster is deployed in the honeypot environment, including servers that provide services such as SALTSTACK, SSH, WEBLOGIC, NGINX, STRUTS, ELASTICSEARCH, SOLR, etc. The above services are all running in a normal CVM. Each service is doing business, has a large CPU usage, and also forges a large amount of input and output. After the attacker invades the honeypot, after entering top, ps, pstree, vmstat, dstat, uptime, cat / proc / pid / *, mpstat, free, etc. in the terminal, the cloud honeypot replaces the command program. After receiving the terminal input, the replaced program parses the command and parameters, and sends the command to the corresponding real server through the host. For example, if the attacker invades the nginx honeypot, the command parameter will send the attacker's input command to the nginx real server, and the nginx real server will execute the corresponding command and return the command execution result to the cloud honeypot.

[0117] like Figure 5 As shown, the attacker inputs the service process query command and parameters in the terminal accessing the cloud honeypot; the service process query command and parameters are shared to the host machine through the specified file, so that the host machine can further remotely determine whether the service process query command is executed by the host machine or the server. When the host machine determines that the service process query command is executed by the server, the service process query command is sent to the server, so that the server executes the service process query command, and obtains the execution result of the server executing the service process query command, and then returns the execution result of the service process query command to the cloud honeypot.

[0118] Specifically, Figure 6 As shown, when the attacker enters the service process query command and parameters in the terminal accessing the cloud honeypot, the input service process query command has been hooked in the cloud honeypot, so that the service process query command will be sent directly to the cloud honeypot. Based on the cloud honeypot, the service process query command is identified and analyzed for the access data type to confirm whether the command and parameters need to be executed remotely and whether they are safe.

[0119] Furthermore, the service process query command is a command that needs to be executed remotely. Cloud Honeypot shares the service process query command and parameters to the host machine through a specified file. The agent on the host machine receives the service process query command. The agent on the host machine will parse the command and parameters again to confirm whether the service process query command needs to be executed remotely and whether the command execution is safe.

[0120] When the host machine detects that the service process query command is a command that needs to be executed by the real server, it will transmit the service process query command and parameters to the corresponding real server. After receiving the attacker's command, the real server will parse the command and parameters again, and execute it immediately if it is safe. After execution, the execution result will be saved. In the specific implementation, the real server is configured with a server agent resident process, which can be used to receive and process the attacker's commands, and feed back the service process information to the attacker's terminal through the host machine, so as to deceive the attacker.

[0121] The real server returns the command execution result to the host machine. The command execution result can be returned according to the transmission path of the command, such as real server->host machine->cloud honeypot. Specifically, the host machine writes the command execution result to the shared file of the honeypot docker where the cloud honeypot is located. The cloud honeypot reads the file content in the shared file and feeds it back to the terminal output display of the access object. The access object can then obtain the service process information.

[0122] In some embodiments, when the host determines that the command meets the command execution condition of the server, the host sends the command to the server matching the cloud honeypot through the host, including: when the host determines that the command is a timed refresh command that meets the command execution condition of the server, according to the refresh time obtained by the host parsing the command, the host sends the command to the server matching the cloud honeypot through the host at a fixed time;

[0123] Furthermore, receiving the service process information fed back by the server through the host machine includes: receiving the service process information fed back periodically by the server through the host machine according to a refresh time.

[0124] In a specific application, for commands and parameters that are refreshed every second, such as top, at least one of the cloud honeypot and the host machine will determine whether the current command is a command that needs to be refreshed regularly during command parsing. If so, the refresh timing is obtained, and the host machine can transmit the command to the real server agent regularly according to the obtained timing, which is equivalent to splitting a command that is refreshed regularly into multiple commands and sending them to the real server regularly, so that the real server can receive the command request regularly, execute the command regularly, and send the command execution result of the execution command to the host machine regularly, so that the host machine can feedback the command execution result to the cloud honeypot according to the receiving rhythm of the command execution result.

[0125] like Figure 7As shown in the figure, it is the execution result of the top command on the nginx honeypot. There is only one nginx process on the nginx honeypot, and it occupies less than 1c1g of resources. However, the output result of executing the top command is the command execution result of the real nginx server, which contains rich and real data and is refreshed every second with a delay of only tens of milliseconds, which is almost indistinguishable from the real thing.

[0126] In this embodiment, by identifying the command of periodic refresh and sending the command to the server at regular intervals, the execution result of the command of periodic refresh can be obtained, which can improve the camouflage effect of the cloud honeypot.

[0127] In some embodiments, the cloud honeypot camouflage implementation method also includes: obtaining the honeypot service information and probe type information configured by the defender; creating a cloud honeypot that matches the honeypot service information; and sending the target probe created according to the probe type information to the cloud honeypot to establish a binding relationship with the cloud honeypot.

[0128] The honeypot service information is information used to describe the cloud honeypot to be created. Based on the honeypot service information, a cloud honeypot matching the honeypot service information can be created. The probe type information is information used to describe the probe type of the target probe to be created. Based on the probe type information, a target probe that meets the probe type represented by the probe type information can be created.

[0129] Specifically, a cloud honeypot can be created in a honey farm, which is a collection of many honeypots. Each honeypot in a honey farm can be deployed in the same host machine or in different hosts in the same host machine cluster.

[0130] After the target probe is created, it is also necessary to bind the target probe to the honeypot to implement access diversion based on the target probe. Specifically, the process of establishing the binding relationship between the target probe and the cloud honeypot may be to send the target probe to the cloud honeypot to establish the binding relationship between the target probe and the cloud honeypot.

[0131] In this embodiment, a cloud honeypot and a target probe are created respectively according to the honeypot service information and the probe type information, and a binding relationship between the target probe and the cloud honeypot is established by sending the target probe to the cloud honeypot. This can effectively simplify the creation process of the cloud honeypot and the target probe and improve the convenience of establishing the binding relationship.

[0132] In some embodiments, creating a cloud honeypot that matches the honeypot service information includes: determining the honeypot type to which the cloud honeypot that matches the honeypot service information belongs; creating a cloud honeypot when there is a server matching the honeypot type in the server cluster; further, after creating the cloud honeypot, the cloud honeypot camouflage implementation method also includes: determining the successfully matched server as a server that matches the cloud honeypot.

[0133] Among them, the honeypot type is used to describe the type of service that the honeypot can provide. Honeypots of the same type can correspond to the same server in the server cluster. Therefore, in the process of implementing honeypot disguise and deceiving access objects, only one server of each honeypot type is needed to build a real service cluster. The command execution of all types of honeypots can point to this set of real service clusters, which is cost-controllable.

[0134] In this embodiment, the successfully matched server is determined as the server that matches the cloud honeypot, and a correspondence between the server and the cloud honeypot can be established so that the commands of the cloud honeypot can be executed through the server that matches the cloud honeypot, thereby achieving the effect of hiding the cloud honeypot and deceiving the access objects of the cloud honeypot.

[0135] In some embodiments, the number of cloud honeypots is at least one. Sending the target probe created according to the probe type information to the cloud honeypot and establishing a binding relationship with the cloud honeypot includes: sending the target probe created according to the probe type information to each cloud honeypot respectively, and establishing a binding relationship between the target probe and each cloud honeypot respectively.

[0136] The defender can create multiple cloud honeypots, and one target probe can be bound to multiple cloud honeypots. For access objects with different attributes, or access objects with different access realities, or access objects with different interactive behaviors, traffic can be directed to different cloud honeypots. The specific traffic diversion logic can be set according to the actual application scenario.

[0137] In this embodiment, by sending the target probes created according to the probe type information to each cloud honeypot respectively, and establishing a binding relationship between the target probe and each cloud honeypot respectively, it is possible to achieve a one-to-many binding between the target probe and the cloud honeypot, realize multi-mode cloud honeypot diversion, and improve the scalability of the application scenario.

[0138] In some embodiments, the cloud honeypot camouflage implementation method further includes: when the configured probe type information includes probe information representing multiple probe types, creating target probes according to each probe type. Further, sending the target probes created according to the probe type information to the cloud honeypot and establishing a binding relationship with the cloud honeypot includes: sending each type of target probe to the cloud honeypot and establishing a binding relationship between each type of target probe and the cloud honeypot.

[0139] The number of target probes created by the defender can be multiple, and one cloud honeypot can be bound to multiple target probes. Access objects that access different target probes can be directed to the same cloud honeypot.

[0140] In this embodiment, various types of target probes are sent to the cloud honeypot, and binding relationships between various types of target probes and cloud honeypots are established respectively, so that one-to-many binding between cloud honeypots and target probes can be realized, and access objects can be diverted to the same cloud honeypot through multiple probes. It can be suitable for defenders with small access volume but more access methods, and provide them with a convenient cloud honeypot camouflage implementation method based on the least resource consumption.

[0141] In some embodiments, Figure 8 As shown, a method for implementing cloud honeypot camouflage is also provided, and the method includes the following steps:

[0142] Step 802, obtain the honeypot service information and probe type information configured by the defender, and determine the honeypot type to which the cloud honeypot matching the honeypot service information belongs.

[0143] Honeypot service information is used to describe the cloud honeypot that needs to be created. Based on the honeypot service information, a cloud honeypot that matches the honeypot service information can be created. Probe type information is used to describe the probe type of the target probe that needs to be created. Based on the probe type information, a target probe that conforms to the probe type represented by the probe type information can be created. Specifically, a cloud honeypot can be created in a honey farm. A honey farm is a collection of many honeypots. Each honeypot in a honey farm can be deployed in the same host machine or in different hosts in the same host machine cluster.

[0144] Step 804: If there is a server matching the honeypot type in the server cluster, create a cloud honeypot.

[0145] Among them, the honeypot type is used to describe the type of service that the honeypot can provide. Honeypots of the same type can correspond to the same server in the server cluster. Therefore, in the process of implementing honeypot disguise and deceiving access objects, only one server of each honeypot type is needed to build a real service cluster. The command execution of all types of honeypots can point to this set of real service clusters, which is cost-controllable.

[0146] Step 806, create a target probe according to the probe type information, send the target probe to each cloud honeypot respectively, and establish a binding relationship between the target probe and each cloud honeypot respectively.

[0147] Step 808: When the configured probe type information includes probe information representing a plurality of probe types, create a target probe according to each probe type.

[0148] Step 810: Send each type of target probe to the cloud honeypot, and establish a binding relationship between each type of target probe and the cloud honeypot.

[0149] Among them, the number of cloud honeypots created by the defender can be multiple, and one target probe can be bound to multiple cloud honeypots. For access objects with different attributes, or access objects with different access actualities, or access objects with different interactive behaviors, it is possible to divert traffic to different cloud honeypots. The specific diversion logic can be set according to the actual application scenario. By sending the target probes created according to the probe type information to each cloud honeypot, and establishing the binding relationship between the target probe and each cloud honeypot, it is possible to achieve a one-to-many binding between the target probe and the cloud honeypot, and achieve multi-mode cloud honeypot diversion, thereby improving the scalability of the application scenario. In addition, by sending each type of target probe to the cloud honeypot, and establishing the binding relationship between each type of target probe and the cloud honeypot, it is possible to achieve a one-to-many binding between the cloud honeypot and the target probe, and it is possible to achieve the diversion of access objects to the same cloud honeypot through multiple probes. It can be suitable for defenders with small access volume but more access methods, and provide them with a convenient honeypot camouflage implementation method based on the minimum resource consumption.

[0150] Step 812: perform access monitoring based on the target probe bound to the cloud honeypot.

[0151] The target probe can be used as bait to attract attackers. The target probe is likely to be an attacker targeting the defender. By establishing a binding relationship between the target probe and the cloud honeypot, the host can divert the target probe to the cloud honeypot so that the cloud honeypot can analyze the behavior or means of the target, and further analyze the attack behavior and means of the target in the access process, and formulate corresponding defense measures.

[0152] Step 814: When the access object is detected by the target probe, a command input by the access object is obtained.

[0153] The commands input by the access object may specifically include commands for viewing network resource information, commands for viewing physical resource information, commands for viewing service process information, etc.

[0154] Step 816, perform access data type identification and analysis on the command to determine the execution object of the command, where the execution object is used to provide access data that conforms to the access data type of the command.

[0155] Access data type identification and analysis is to determine the data type of the data required to execute the command, including network resource data, physical resource data, service process data, etc. Different access data types can be configured with different data providers, that is, the execution objects of the command.

[0156] Step 818, when the command is a network address query command, determine the honeypot address camouflage logic of the cloud honeypot based on the address of the target probe.

[0157] Step 820, use the honeypot address camouflage logic to replace the original execution logic of the command to obtain the updated execution logic, so that when the cloud honeypot executes the network address query command, it can obtain the address of the target probe.

[0158] The honeypot address camouflage logic is used to make the result obtained when executing the network address query command replace the container address of the cloud honeypot with the address of the target probe. The cloud honeypot uses the honeypot address camouflage logic to replace the original execution logic of the command and obtain the updated execution logic, so that when the cloud honeypot executes the network address query command, it is executed according to the updated execution logic, so that the address obtained by executing the network address query command is the address of the target probe.

[0159] Step 822: When the execution object is a remote execution object associated with the cloud honeypot, determine the remote execution logic defined for the command in the remote execution object.

[0160] Step 824: Use the remote execution logic as a part of the command execution logic to update the original execution logic of the command to obtain updated execution logic.

[0161] Specifically, when the execution object is a remote execution object associated with the cloud honeypot, the remote execution logic defined for the command in the remote execution object is determined, and the execution logic for the command in the cloud honeypot is updated to the cloud honeypot's sending processing logic for the command and the receiving processing logic for the command execution result of the remote execution object, and the remote execution logic is used as a part of the command execution logic to update the original execution logic of the command to obtain the updated execution logic. The updated execution logic includes the sending processing logic of the cloud honeypot sending the command to the remote execution object, the remote execution logic defined for the command in the remote execution object, and the receiving processing logic of the cloud honeypot obtaining the command execution result of the remote execution object.

[0162] Step 826, send the command to the host machine that provides the operating environment for the container where the cloud honeypot is located through the command sharing file.

[0163] Among them, the command execution conditions of the host machine include that the command is a security command and the access data type of the command is physical resource information. The cloud honeypot has the permission to write to the command shared file, and the remote execution object has the permission to read the command shared file. The cloud honeypot can write the command to the command shared file, and the remote execution object can read the command from the command shared file, thereby realizing the sharing of the command from the cloud honeypot to the remote execution object. The remote execution object has the permission to write to the execution result shared file, and the cloud honeypot has the permission to read the execution result shared file. The remote execution object can write the command execution result to the execution result shared file, and the cloud honeypot can read the command execution result from the execution result shared file, thereby realizing the sharing of the command execution result from the remote execution object to the cloud honeypot.

[0164] Step 828, receiving the physical resource information fed back by the host machine, where the physical resource information is generated by the host machine when executing the command if it is determined that the command meets the command execution condition of the host machine.

[0165] The host receives the physical resource query command, parses the command and parameters again, confirms whether the command needs to be executed remotely and whether the command execution is safe. The host executes the relevant command on the host, configures the same parameters, executes the physical resource query command, and obtains the execution result of the physical resource query command. The host returns the execution result of the physical resource query command to the cloud honeypot, which is transmitted in the form of a shared file between the honeypot container of the cloud honeypot and the host. The cloud honeypot monitors the data update of the shared file. The command program in the cloud honeypot replaces and updates the execution logic and receives the command execution result from the host, and outputs the command execution result to the terminal where the access object is located.

[0166] Step 830, when the host determines that the command is a timed refresh command that meets the command execution conditions of the server, the host sends the command to the server matching the cloud honeypot according to the refresh time obtained by parsing the command by the host.

[0167] Among them, the command execution conditions of the server include that the command is a security command and the access data type of the command is service process information. When the host determines that the command meets the command execution conditions of the server, it will determine that the command needs to be executed by the server. The host can send the command from the host to the server through interaction with the server, and the server executes the command. Since the access data type of the command is service process information, the server can generate the service process information of the server through the command execution logic defined for the command, and feed the service process information back to the host, and the host will share the process information fed back by the server to the cloud honeypot.

[0168] Step 832: Receive service process information that is periodically fed back by the server through the host machine according to the refresh time.

[0169] Among them, the service process information is generated by the server executing the command according to the defined execution logic. When the command is a command that needs to be refreshed regularly, the refresh timing is obtained, and the host machine can transmit the command to the real server regularly according to the obtained timing, so that the real server can receive the command request regularly, execute the command regularly, and send the command execution result of the execution command to the host machine regularly, so that the host machine can feedback the command execution result to the cloud honeypot according to the receiving rhythm of the command execution result.

[0170] The present application also provides an application scenario, which applies the above-mentioned cloud honeypot camouflage implementation method. Most honeypots on the market are divided into cloud honeypots and non-cloud honeypots. The offline camouflage implementation of non-cloud honeypots is relatively simple, and users can also configure the honeypot machine separately to achieve the camouflage effect, and it does not require network camouflage or physical resource camouflage. When the cloud honeypot provides SAAS delivery, manufacturers are required to provide unified and automated camouflage. Looking at the exposed honeypot solutions, it is not seen that each manufacturer has an independent solution for camouflage, and users still need to configure and construct the camouflaged data themselves.

[0171] Traditional honeypots require honeypot manufacturers and maintenance personnel to clone disguised data from existing customer services and put them on the honeypot, and it is difficult to construct a large amount of input and output on the honeypot service. Secondly, both the machine cost and labor cost are relatively high.

[0172] Based on cloud services, this solution provides SAAS honeypot delivery. After the customer deploys the honeypot and probe network, the cloud server honeypot background will automatically help the user build the honeypot network camouflage, so that the ip and mac address display on the honeypot are consistent with the probe address. Physical resource camouflage makes the physical resources of the honeypot seen by the attacker normal cvm, shielding the properties of the honeypot on the container. Process running information camouflage allows attackers to see complex processes running normally and with a large amount of input and output on a simple honeypot. In addition, the customer can provide the customer's normal service address, and the honeypot will learn and camouflage, making it more difficult for attackers to distinguish the true from the false. Even if the attacker logs in to the background of the honeypot and queries the various environmental information of the honeypot, it cannot discover its true nature as a honeypot.

[0173] This solution disguises the honeypot docker, which occupies very little physical resources and network traffic, as a complex and important server. Specifically, the honeypot deception is divided into network resource disguise, physical resource disguise such as machine CPU and memory, and process running information disguise. Disguise is to make the honeypot behave exactly like the real service through some disguise means, so as to confuse the attacker and make him believe that the environment being attacked is not a honeypot but a real service. Finally, it helps the defender capture the attacker's attack manual, the attacker's source information, and delay the attacker for more time.

[0174] Among them, network resource camouflage means that because the honeypot is deployed in a container, the IP seen through the network system command (ip, ifconfig, etc.) is the container IP, not the public network or intranet IP from which the attacker attacks, so the attacker can immediately find that this is a honeypot. Therefore, network resource camouflage replaces the system network command, so that the attacker finds that the mac, ip and other addresses of the honeypot match the address attacked by the attacker, thereby deceiving the attacker.

[0175] Disguise physical resources such as machine CPU and memory means that the physical resources occupied by honeypots are generally small and in a docker environment. By replacing system commands (mpstat, etc.) and hooking the meminfo and cpuinfo files in the / proc directory, the output seen by users through query commands is not the content of the actual docker resource files, thereby confusing attackers.

[0176] Process running information disguise: The normal operation of the process is the most representative of whether the current service is a real service. If the attacker sees that the process on the honeypot is running normally, the operation not only occupies a large part of the CPU and memory, but also is accompanied by a large input and output, the attacker will easily mistake the honeypot for a real service. After attacking the honeypot, the attacker generally uses commands such as top, ps, and vmstat to view the running process of the current service. Honeypot disguise replaces these system commands and sends the output results of the process running on the real service to the honeypot for display, so as to achieve a fake effect.

[0177] Specifically, the application of the cloud honeypot camouflage implementation method in this application scenario is as follows:

[0178] First, let's introduce honeypot network camouflage. The defender can choose to create probe types and honeypot services through the WEB console. Probes are network resources and are the form of external exposure of honeypot services. Common probes include public network IP, intranet IP, domain name, etc. Honeypots are services, which can be virtual machine services. Honeypots are deployed in containers, and the host provides a running environment for the containers where honeypots are deployed. The number of honeypots created by the defender can be one or more, and the number of probes can also be one or more. When establishing an association between honeypots and probes, honeypots can be bound to multiple probes, and probes can also be bound to multiple honeypots.

[0179] The target probe can be used as bait to attract attackers on the defender side. The access object accessed through the target probe is likely to be an attacker targeting the defender. By establishing a binding relationship between the target probe and the cloud honeypot, the host can divert the access object accessed through the target probe to the cloud honeypot so that the cloud honeypot can analyze the behavior or means of the access object to determine whether the access object is an attacker on the defender side. If so, the defender can further analyze the attack behavior and means of the access object during the access process and formulate corresponding defense measures. By binding the honeypot and the probe for diversion, the efficiency and accuracy of monitoring the access object can be improved.

[0180] Specifically, Figure 8 As shown in the figure, the defender chooses to create a probe type and honeypot service in the WEB console. The probe is a network resource, and the honeypot is a service. A honeypot can be bound to multiple probes, and a probe can also be bound to multiple honeypots. The configuration information of the honeypot and probe is saved in MYSQL. The host background service reads all the current user's rules from MYSQL, creates the probe type selected by the user, and performs traffic traction. The host sends the honeypot type selected by the user to the secret field to create a honeypot of the specified type. After the probe is bound to the honeypot, the host will automatically generate network camouflage information, send the public network ip or intranet ip and mac address of the probe to the honeypot, and load it into the system command module tampered with by the honeypot. The attacker invades the honeypot through the probe and uses commands such as ip addr, ip route, ifconfig, and hostname to view the network information of the honeypot. The ip and ifconfig commands tampered by the honeypot will be loaded into the mac and ip addresses of the probe and output to the attacker's terminal, so that the attacker finds that the attacking ip is consistent with the ip on the target machine, and no network traction and dnat operations have occurred. After the attacker enters the honeypot service, he will perform a series of malicious actions, such as lateral movement scanning, blasting, and pulling data processing samples. The honeypot service records these actions in real time, and then reports them to the defender's console and presents them all to the defender's users.

[0181] The following describes the implementation process of physical resource camouflage. The physical resource camouflage of the honeypot is implemented through the host machine. The commands and parameters entered by the attacker are transmitted to the host machine of the honeypot. After the commands are executed on the honeypot host machine, the command execution results are returned to the honeypot and output to the terminal where the access object is located. From the attacker's perspective, the honeypot outputs the files of real physical resources.

[0182] Specifically, the attacker enters commands (top, ps, pstree, vmstat, dstat, uptime, cat / proc / pid / *, mpstat, free) in the terminal accessing the cloud honeypot; the entered commands have been hooked in the cloud honeypot, and the cloud honeypot parses and analyzes the commands to determine whether the command needs to be executed remotely. If it only needs to be executed locally, it can be executed immediately. If remote execution is required, the command and parameters are shared to the host through the specified file so that the host can execute the command remotely. Specifically, the agent on the host receives the command, parses the command and parameters again, confirms whether the command needs to be executed remotely and confirms whether the command execution is safe. The host agent executes the relevant commands on the host, configures the same parameters, executes the command, and obtains the execution result of the command. The host agent returns the command execution result to the cloud honeypot, which is transmitted through the honeypot container of the cloud honeypot and the shared file of the host. The cloud honeypot monitors the data update of the shared file. The command program replaced in the cloud honeypot with updated execution logic receives the command execution result from the host and outputs the command execution result to the terminal where the access object is located.

[0183] Next, we will introduce the implementation process of honeypot service process information disguise. A real server cluster is deployed in the honeypot environment, including servers that provide services such as SALTSTACK, SSH, WEBLOGIC, NGINX, STRUTS, ELASTICSEARCH, SOLR, etc. The above services are all running in a normal CVM. Each service is doing business, has a large CPU usage, and also forges a large amount of input and output. After the attacker invades the honeypot, after entering top, ps, pstree, vmstat, dstat, uptime, cat / proc / pid / *, mpstat, free, etc. in the terminal, the cloud honeypot replaces the command program. After receiving the terminal input, the replaced program parses the command and parameters, and sends the command to the corresponding real server through the host. For example, if the attacker invades the nginx honeypot, the command parameter will send the attacker's input command to the nginx real server, and the nginx real server will execute the corresponding command and return the command execution result to the cloud honeypot.

[0184] The attacker enters commands (top, ps, pstree, vmstat, dstat, uptime, cat / proc / pid / *, mpstat, free) and parameters in the terminal accessing the cloud honeypot; the input command has been hooked in the cloud honeypot, and the cloud honeypot parses and analyzes the command to confirm whether the command and parameters need to be executed remotely and whether they are safe. If only local execution is required, it can be executed immediately. If remote execution is required, the command and parameters are shared to the host through the specified file so that the host can remotely execute the command. Specifically, the agent on the host receives the command, parses the command and parameters again, and confirms whether the command needs to be executed remotely and whether the command execution is safe. If it is not safe or does not need to be executed remotely, it can be directly discarded. The host transmits the command and parameters to the corresponding real server through zk or http. The server agent resident process also runs on the real server to receive and process the attacker's command. After receiving the attacker's command on the real server, the command and parameters are parsed again. If it is safe, it will be executed immediately, and the execution result will be saved after execution.

[0185] The real server returns the command execution result to the host machine. The command execution result can be returned according to the transmission path of the command, such as real server->host machine->cloud honeypot. Specifically, the host machine writes the command execution result to the shared file of the honeypot docker where the cloud honeypot is located. The cloud honeypot reads the file content in the shared file and feeds it back to the terminal output display of the access object, and the access object can see the output.

[0186] Furthermore, for commands and parameters that are refreshed every second, such as top, the command parsing will determine whether the current command is refreshed regularly and obtain the refresh timing. Then the command is transmitted to the real service agent regularly, which is equivalent to splitting a regularly refreshed command into multiple commands and sending them to the real server regularly. The real server receives the command request regularly and returns the command execution result after executing it.

[0187] The solution of this application is dedicated to solving the problem that honeypots are easily discovered and detected by attackers. When a honeypot is deployed in a container, an attacker can immediately detect the honeypot by using a few simple commands (ip, top, etc.). Even if an attacker steps into a honeypot, he can react immediately, so most of the time the attacker stays in the honeypot for a very short time, usually only a few minutes. In addition, the honeypot cannot capture more attack behaviors and means.

[0188] The command-based remote execution solution of this application takes over various system commands (ip, config, top, ps, pstree, vmstat, dstat, uptime, cat / proc / pid / *, mpstat, free) in the honeypot, sends the commands to the remote real server for execution, and returns the execution results to the honeypot. The output data seen by the attacker on the honeypot terminal cannot be distinguished as true or false. Therefore, the attacker can no longer use simple commands to identify whether the current attack target is a honeypot, which can significantly increase the attacker's stay time in the honeypot and record more attack methods.

[0189] The real service cluster used in this patent only needs to build one set (one for each honeypot type). The command execution of all honeypots can point to this set of real service clusters. When new types of honeypots are added later, there is no need to separately develop and build disguised data into the honeypots. This set of architecture can continue to be used. Only one more real server needs to be added, which is conducive to reducing server deployment costs.

[0190] The above cloud honeypot camouflage implementation method can monitor the access object through the target probe by acquiring a target probe that has a binding relationship with the cloud honeypot, and introduce the access object into the cloud honeypot to collect the access object's behavior and means when accessing the cloud honeypot. When the access object wants to identify whether to enter the honeypot through the execution result of the command, the original execution logic of the command is updated to obtain the updated execution logic, so that the execution result obtained by executing the command is the same as the execution result obtained by the access object accessing the real server environment. Based on the execution result obtained by executing the command according to the updated execution logic, the effect of camouflaging and deceiving the access object can be achieved, and the honeypot can be prevented from being identified by the access object, so that the attacker as the access object can stay in the honeypot for a long time, and more attack behaviors and means of the access object can be captured through the honeypot, thereby improving the application effect of the deployed honeypot.

[0191] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0192] Based on the same inventive concept, the embodiment of the present application also provides a cloud honeypot disguise implementation device for implementing the cloud honeypot disguise implementation method involved above. The implementation solution provided by the device to solve the problem is similar to the implementation solution recorded in the above method, so the specific limitations in one or more cloud honeypot disguise implementation device embodiments provided below can refer to the limitations of the cloud honeypot disguise implementation method above, and will not be repeated here.

[0193] In one embodiment, Fig.10 As shown, a cloud honeypot camouflage implementation device is provided, including: an access monitoring module 1002, a command acquisition module 1004, a command update module 1006 and an execution result feedback module 1008, wherein:

[0194] Access monitoring module 1002, used to obtain a target probe bound to a cloud honeypot, and perform access monitoring based on the target probe; obtain a target probe bound to a cloud honeypot, and perform access monitoring based on the target probe;

[0195] A command acquisition module 1004 is used to acquire a command input by the access object when the access object is monitored by the target probe;

[0196] A command update module 1006, configured to update the original execution logic of the command based on the cloud honeypot to obtain an updated execution logic, wherein the updated execution logic is configured to make the execution result obtained by executing the command the same as the execution result obtained by the access object accessing the real server environment;

[0197] The execution result feedback module 1008 is used to execute the command according to the update execution logic, obtain the execution result, and feed back the execution result to the access object.

[0198] In some embodiments, the command update module 1006 is also used to perform access data type identification analysis on the command based on the cloud honeypot, determine the execution object of the command, and the execution object is used to provide access data that conforms to the access data type of the command; based on the execution logic defined in the execution object, update the original execution logic of the command to obtain the updated execution logic.

[0199] In some embodiments, when the command is a network address query command, the execution object is the cloud honeypot;

[0200] The command update module 1006 is also used to determine the honeypot address camouflage logic of the cloud honeypot based on the address of the target probe; use the honeypot address camouflage logic to replace the original execution logic of the command to obtain an updated execution logic, so that when the cloud honeypot executes the network address query command, it can obtain the address of the target probe.

[0201] In some embodiments, the command update module 1006 is also used to determine the remote execution logic defined for the command in the remote execution object when the execution object is a remote execution object associated with the cloud honeypot; use the remote execution logic as part of the command execution logic, update the original execution logic of the command, and obtain the updated execution logic.

[0202] In some embodiments, a command sharing file and an execution result sharing file are constructed between the remote execution object and the cloud honeypot; the cloud honeypot camouflage implementation device further includes a command execution processing module. The command execution processing module is used to write the command into the command sharing file based on the updated execution logic when the execution object is the remote execution object, so that the remote execution object executes the newly added command in the command sharing file according to the remote logic, and writes the execution result of the command into the execution result sharing file; and obtains the execution result of the command from the execution result sharing file.

[0203] In some embodiments, the cloud honeypot camouflage implementation device further includes a command execution processing module. The command execution processing module is used to send the command to the host machine that provides the operating environment for the container where the cloud honeypot is located when the execution object is the remote execution object; the command execution conditions of the host machine include that the command is a security command and the access data type of the command is physical resource information; and receive the physical resource information generated and fed back by the host machine when the command is executed when the host machine determines that the command meets the command execution conditions of the host machine.

[0204] In some embodiments, the cloud honeypot camouflage implementation device further includes a command execution processing module. The command execution processing module is used to send the command to a server matching the cloud honeypot through the host machine when the host machine determines that the command meets the command execution conditions of the server; the command execution conditions of the server include that the command is a security command and the access data type of the command is service process information; receive the service process information fed back by the server through the host machine, and the service process information is generated by the server executing the command according to the defined execution logic.

[0205] In some embodiments, the command execution processing module is used to send the command to the server matching the cloud honeypot through the host machine at a scheduled time according to the refresh time obtained by parsing the command by the host machine when the host machine determines that the command is a scheduled refresh command that meets the command execution conditions of the server; and receive service process information that the server regularly feeds back through the host machine according to the refresh time.

[0206] In some embodiments, the cloud honeypot camouflage implementation device also includes a probe and honeypot creation module, which is used to obtain the honeypot service information and probe type information configured by the defender; create a cloud honeypot that matches the honeypot service information; and send the target probe created according to the probe type information to the cloud honeypot to establish a binding relationship with the cloud honeypot.

[0207] In some embodiments, the probe and honeypot creation module is also used to determine the honeypot type to which the cloud honeypot matching the honeypot service information belongs; if there is a server matching the honeypot type in the server cluster, create the cloud honeypot; and determine the successfully matched server as the server matching the cloud honeypot.

[0208] In some embodiments, the number of the cloud honeypots is at least one; the probe and honeypot creation module is also used to send the target probe created according to the probe type information to each of the cloud honeypots, and establish a binding relationship between the target probe and each of the cloud honeypots.

[0209] In some embodiments, the probe and honeypot creation module is also used to create target probes according to each probe type when the configured probe type information includes probe information that respectively represents multiple probe types; send each type of the target probe to the cloud honeypot, and establish a binding relationship between each type of the target probe and the cloud honeypot.

[0210] The cloud honeypot camouflage implementation device creates a target probe as bait in response to the configuration operation of the defender, establishes a binding relationship between the cloud honeypot and the target probe, and can monitor the access object through the target probe, and introduce the access object into the cloud honeypot configured by the defender, so as to collect the behavior and means of the access object when accessing the cloud honeypot. When the access object wants to identify whether to enter the honeypot through the execution result of the command, the original execution logic of the command is updated to obtain the updated execution logic, so that the execution result obtained by executing the command is the same as the execution result obtained by the access object accessing the real server environment. Based on the execution result obtained by executing the command according to the updated execution logic, it is possible to achieve camouflage and deceive the access object, and prevent the honeypot from being identified by the access object, so that the attacker as the access object can stay in the honeypot for a long time, and more attack behaviors and means of the access object can be captured through the honeypot, thereby improving the application effect of the deployed honeypot.

[0211] Each module in the above-mentioned cloud honeypot camouflage implementation device can be implemented in whole or in part by software, hardware and their combination. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the corresponding operations of the above modules.

[0212] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Fig.11 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a cloud honeypot camouflage implementation method is implemented.

[0213] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Fig.12As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless method can be implemented through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a cloud honeypot camouflage implementation method is implemented. The display unit of the computer device is used to form a visually visible image, and can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen. The input device of the computer device can be a touch layer covered on the display screen, or a button, trackball or touchpad set on the computer device casing, or an external keyboard, touchpad or mouse, etc.

[0214] Those skilled in the art will understand that Fig.11 or Fig.12 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0215] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0216] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0217] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0218] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0219] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0220] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0221] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A cloud honeypot camouflage implementation method, characterized in that: The method comprises: Obtain a target probe bound to the cloud honeypot, and perform access monitoring based on the target probe; When the target probe detects the access object, obtaining a command input by the access object; The original execution logic of the command is updated based on the cloud honeypot to obtain an updated execution logic, wherein the updated execution logic is used to make the execution result obtained by executing the command the same as the execution result obtained by the access object accessing the real server environment; The command is executed according to the update execution logic to obtain an execution result, and the execution result is fed back to the access object.

2. The method according to claim 1, characterized in that The updating of the original execution logic of the command based on the cloud honeypot to obtain the updated execution logic includes: Based on the cloud honeypot, performing access data type identification and analysis on the command to determine an execution object of the command, where the execution object is used to provide access data that conforms to the access data type of the command; Based on the execution logic defined in the execution object, the original execution logic of the command is updated to obtain the updated execution logic.

3. The method according to claim 2, characterized in that In the case where the command is a network address query command, the execution object is the cloud honeypot; The updating of the original execution logic of the command based on the execution logic defined in the execution object to obtain the updated execution logic includes: Based on the address of the target probe, determining the honeypot address camouflage logic of the cloud honeypot; The original execution logic of the command is replaced by the honeypot address camouflage logic to obtain an updated execution logic, so that when the cloud honeypot executes the network address query command, the address of the target probe is obtained.

4. The method according to claim 2, characterized in that: The updating of the original execution logic of the command based on the execution logic defined in the execution object to obtain the updated execution logic includes: In a case where the execution object is a remote execution object associated with the cloud honeypot, determining a remote execution logic defined for the command in the remote execution object; The remote execution logic is used as a part of the command execution logic, and the original execution logic of the command is updated to obtain the updated execution logic.

5. The method according to claim 4, characterized in that A command sharing file and an execution result sharing file are constructed between the remote execution object and the cloud honeypot; the method further includes: In the case where the execution object is the remote execution object, based on the updated execution logic, the command is written into the command sharing file, so that the remote execution object executes the newly added command in the command sharing file according to the remote logic, and the execution result of the command is written into the execution result sharing file; The execution result of the command is obtained from the execution result sharing file.

6. The method according to claim 4, characterized in that The method further comprises: In the case where the execution object is the remote execution object, the command is sent to a host machine that provides a running environment for the container where the cloud honeypot is located; the command execution conditions of the host machine include that the command is a security command and the access data type of the command is physical resource information; The physical resource information fed back by the host machine is received, where the physical resource information is generated when the host machine executes the command when determining that the command meets the command execution condition of the host machine.

7. The method according to claim 6, characterized in that The method further comprises: When the host determines that the command meets the command execution condition of the server, the command is sent to the server matching the cloud honeypot through the host; the command execution condition of the server includes that the command is a security command and the access data type of the command is service process information; The service process information fed back by the server through the host machine is received, where the service process information is generated by the server executing the command according to a defined execution logic.

8. The method according to claim 7, characterized in that When the host machine determines that the command meets the command execution condition of the server, sending the command to the server matching the cloud honeypot through the host machine includes: When the host determines that the command is a timed refresh command that meets the command execution condition of the server, the host sends the command to the server matching the cloud honeypot at a fixed time according to the refresh time obtained by parsing the command by the host; The receiving the service process information fed back by the server through the host machine includes: Receive the service process information that is periodically fed back by the server through the host machine according to the refresh time.

9. The method according to any one of claims 1 to 8, characterized in that The method further comprises: Obtain the honeypot service information and probe type information configured by the defender; Creating a cloud honeypot matching the honeypot service information; The target probe created according to the probe type information is sent to the cloud honeypot, and a binding relationship is established with the cloud honeypot.

10. The method according to claim 9, characterized in that The step of creating a cloud honeypot matching the honeypot service information includes: Determine the honeypot type to which the cloud honeypot matching the honeypot service information belongs; When there is a server matching the honeypot type in the server cluster, creating the cloud honeypot; The method further comprises: The successfully matched server is determined as the server that matches the cloud honeypot.

11. The method according to claim 9, characterized in that The number of the cloud honeypot is at least one; The sending of the target probe created according to the probe type information to the cloud honeypot to establish a binding relationship with the cloud honeypot includes: The target probes created according to the probe type information are respectively sent to each of the cloud honeypots, and binding relationships are respectively established between the target probes and each of the cloud honeypots.

12. The method according to claim 9, characterized in that The method further comprises: When the configured probe type information includes probe information representing a plurality of probe types respectively, creating target probes respectively according to the probe types; The sending of the target probe created according to the probe type information to the cloud honeypot to establish a binding relationship with the cloud honeypot includes: The target probes of each type are sent to the cloud honeypot, and binding relationships between the target probes of each type and the cloud honeypot are established respectively.

13. A cloud honeypot camouflage implementation device, characterized in that: The device comprises: An access monitoring module is used to obtain a target probe bound to a cloud honeypot, and perform access monitoring based on the target probe. The target probe bound to the cloud honeypot is obtained, and access monitoring is performed based on the target probe. A command acquisition module, used for acquiring a command input by an access object when an access object is detected by the target probe; A command update module, used to update the original execution logic of the command based on the cloud honeypot to obtain an updated execution logic, wherein the updated execution logic is used to make the execution result obtained by executing the command the same as the execution result obtained by the access object accessing the real server environment; An execution result feedback module is used to execute the command according to the update execution logic, obtain the execution result, and feed back the execution result to the access object.

14. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 12 are implemented.

15. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 12 are implemented.

16. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 12 are implemented.

Images