Account mixing line generation method in domain environment

Abstract

The invention provides an account mixing line generation method in a domain environment. The method comprises the steps of obtaining an initial user name data set, extracting structural features of the initial user name data set according to preset parameters, and generating a virtual user name data set similar to user names in the initial user name data set according to the structural features; generating a honey point according to the virtual user name data set, and placing the honey point on a set attack path; and obtaining target traffic, analyzing the target traffic to obtain user name information existing in the target traffic, and detecting an attack behavior according to the user name information. According to the method, the virtual user name highly similar to the real user name is generated, the honey point is generated, potential attackers can be induced and tracked by placing the honey point on the set attack path, and then the attack behavior can be timely and accurately detected by analyzing the flow.

Description

Technical Field

[0001] The present invention relates to the field of computer security technology, and in particular to a method for generating an account line in a domain environment. Background Art

[0002] In the field of computer security, methods based on log monitoring, behavioral analysis, threat intelligence, and abnormal access pattern recognition can effectively identify and respond to potential intrusion behaviors.

[0003] These technologies and measures play a vital role in effectively identifying, preventing, and guarding against lateral movement attacks, significantly enhancing the security defense capabilities of organizations. They play a core role in detecting attack patterns, conducting data analysis, and identifying abnormal behaviors, providing enterprises with all-round and multi-layered security protection.

[0004] However, these methods still have shortcomings:

[0005] Log monitoring relies on logs generated by systems and applications. If an attacker disables or tampers with logs, or if some systems are not configured to generate detailed logs, this will limit the effectiveness of monitoring. In addition, log monitoring is usually reactive rather than real-time, which makes monitoring less effective.

[0006] Behavioral analysis typically requires a large amount of historical data to establish a baseline of normal behavior and may not adequately identify emerging attack patterns. In addition, it produces a high rate of false positives.

[0007] Threat intelligence mainly relies on external information sources, which may cause information delays or incomplete matching with the current network environment. In addition, it is more suitable for identifying known threats and has limited effect on identifying new attack methods such as zero-day attacks.

[0008] Abnormal access pattern identification relies on predefined rules or baselines of user behavior and may not detect access behavior that uses legitimate credentials but in an abnormal manner.

[0009] Therefore, it is necessary to provide a method that can accurately detect attack behaviors in a domain environment. Summary of the invention

[0010] The purpose of the present invention is to provide a method for generating an account jig within a domain environment, which is used to generate and deploy bait accounts within the domain environment, thereby forming a new defense layer in a network security architecture to accurately detect attack behaviors within the domain environment.

[0011] In a first aspect, the method for generating an account line in a domain environment provided by the present invention includes: obtaining an initial user name data set, extracting structural features of the initial user name data set according to preset parameters, and generating a virtual user name data set similar to the user names in the initial user name data set according to the structural features; generating a honey spot according to the virtual user name data set, and placing the honey spot on a set attack path; obtaining target traffic, parsing the target traffic to obtain user name information present in the target traffic, and detecting attack behavior based on the user name information.

[0012] The beneficial effect of the method for generating account lines in a domain environment provided by the present invention is that: the Markov chain's ability to analyze character sequences is used to understand and simulate the character arrangement rules in the user name, so that the information in the generated virtual user name data set is highly similar to the initial user name data set. A feasible attack path is designed, and honey spots with user name identifiers are arranged in the attack route to induce and track potential attackers. The attacker's actions can be effectively monitored, and key security intelligence can be collected at the same time to provide support for further strengthening the security protection of the domain environment. By monitoring the traffic and performing analysis, the attack behavior can be detected in a timely and accurate manner.

[0013] In a possible embodiment, when an attack behavior is detected, alarm information is generated according to the detected attack behavior, and the alarm information is sent to a log receiving terminal, and the log receiving terminal is used to provide a query for the alarm information.

[0014] In another possible embodiment, structural features of the initial user name data set are extracted according to preset parameters, and a virtual user name data set similar to the user names in the initial user name data set is generated according to the structural features, including: counting the length of each user name in the initial user name data set, calculating the statistical features and the user name character structure; slicing each user name according to the number of states in a preset Markov chain, and storing them in a preset structure counting table; counting the slice structure counts in the structure counting table and performing smoothing processing to obtain the slice structure frequency, and calculating the continuation probability of the slice structure according to the structure counter; generating a virtual user name length through a normal distribution with the statistical features as parameters, and selecting characters from the structure counting table to construct a virtual user name that meets the virtual user name length to obtain a virtual user name data set.

[0015] The structure counting table includes three structure counters; counting the slice structure counts in the structure counting table and performing smoothing processing to obtain the slice structure frequency, including: traversing the structure counting table to count the slice structure counts in each structure counter; subtracting a set discount value from each slice structure count to obtain the slice structure frequency of each slice structure.

[0016] In other possible embodiments, the attack path is set according to an attack strategy of a network attacker to conduct an intra-domain attack.

[0017] Detecting attack behavior according to the user name information includes: comparing the user name information with the virtual user name data set; and determining that an attack behavior exists when the user name information hits a virtual user name in the virtual user name data set.

[0018] In a second aspect, the present invention further provides a device for generating an account line in a domain environment, comprising:

[0019] The virtual user name generation unit is used to obtain an initial user name data set, extract structural features of the initial user name data set according to preset parameters, and generate a virtual user name data set similar to the user names in the initial user name data set according to the structural features.

[0020] A honey spot setting unit is used to generate a honey spot according to the virtual user name data set and place the honey spot on a set attack path.

[0021] The detection unit is used to obtain target traffic, parse the target traffic to obtain user name information present in the target traffic, and detect attack behavior according to the user name information.

[0022] In a third aspect, the present invention further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the method for generating an account line in the above-mentioned domain environment is implemented.

[0023] In a fourth aspect, the present invention further provides an electronic device, comprising: a processor and a memory; the memory is used to store a computer program; the processor is used to execute the computer program stored in the memory, so that the electronic device executes the above-mentioned account line generation method within the domain environment.

[0024] For the beneficial effects of the second to fourth aspects, reference may be made to the description of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 A schematic diagram of a flow chart of a method for generating an account line in a domain environment provided by an embodiment of the present invention;

[0026] Figure 2 A schematic diagram of a device for generating an account line in a domain environment provided by an embodiment of the present invention;

[0027] Figure 3 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0028] In order to make the purpose, technical solutions and advantages of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be understood by people with general skills in the field to which the present invention belongs. "Including" and similar words used in this article mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0029] This embodiment provides a method for generating an account line in a domain environment. Figure 1 , the method comprising:

[0030] S101: Acquire an initial user name data set, extract structural features of the initial user name data set according to preset parameters, and generate a virtual user name data set similar to the user names in the initial user name data set according to the structural features.

[0031] In a possible embodiment, the initial user name data set may be composed of existing user names obtained from the domain, or may be a preset data set including a certain number of user names. Exemplarily, when the method of the present invention is applied to generate account lines in a domain environment, if the domain management authority is obtained, the existing user names can be called to query to obtain the initial user name data set; if the domain management authority is not obtained, the preset data set including a certain number of user names is applied as the initial user name data set.

[0032] In a possible embodiment, structural features of an initial user name data set are extracted according to preset parameters, and a virtual user name data set similar to the user names in the initial user name data set is generated according to the structural features, including: counting the length of each user name in the initial user name data set, calculating the statistical features and the user name character structure; slicing each user name according to the number of states in a preset Markov chain, and storing them in a preset structure counting table; counting the slice structure count in the structure counting table and performing smoothing to obtain the slice structure frequency, and calculating the continuation probability of the slice structure according to the structure counter; generating a virtual user name length through a normal distribution with the statistical features as parameters, and selecting characters from the structure counting table to construct a virtual user name that meets the virtual user name length to obtain a virtual user name data set.

[0033] In a possible embodiment, the structure counting table includes three structure counters. Counting the slice structure counts in the structure counting table and performing smoothing to obtain the slice structure frequency includes: traversing the structure counting table to count the slice structure counts in each structure counter; and subtracting a set discount value from each slice structure count to obtain the slice structure frequency of each slice structure.

[0034] In a specific embodiment, for the initial user name data set, each user name is traversed, the length of each user name is counted, and the statistical features such as the mean and standard deviation are calculated, and the pronunciation structure of each user name is obtained and stored as a dictionary, and the dictionary is used to filter the valid data in the user name. According to the number of states (i.e., the length of the sequence) n in the preset Markov chain, the user name sequence is sliced ​​to capture the dependency and context information between the elements in the user name sequence: that is, for a sequence of length m, 0 to n bits, 1 to n+1 bits to mn bits to m bits are traversed and read, and then the dependency between the nth bit and the first n-1 bits is constructed according to the slice, and the captured information is stored in the preset structure counting table. In this embodiment, the structure counting table includes the actual result counter, the intermediate structure counter and the ending structure counter. Three structure counters. Among them, 0 to n-1 bits are stored in the starting structure counter, m-n+1 bits to m bits are stored in the ending structure counter, and the rest are all stored in the intermediate structure counter as long as the nth bit in the slice is not empty, so that the context structure construction of the markov chain is completed.

[0035] Traverse the three structure counters and count the counts of all slice structures in each counter. Set an initial discount value and subtract the initial discount value from the count of each slice structure to get the final slice structure frequency to prevent overfitting due to excessive counts. Calculate the continuation probability of the slice structure, that is, the possibility that it appears in other contexts as part of a higher-order slice. Combine the slice structure frequency and continuation probability to calculate the final smoothed continuation probability. Considering that the structures of the usernames in the initial username dataset may have different degrees of sparseness and density, it is necessary to smooth the structure count table to avoid the model estimating the probability of some structures being too low or zero due to too few or even zero occurrences, especially those structures that have never appeared in the training data.

[0036] The smoothed structure count table is applied to generate similar usernames. Specifically, the calculated statistical features (mean and standard deviation) are used as parameters to generate random sentence lengths that conform to the distribution through normal distribution, and the length of the usernames generated subsequently will be close to this length as a target, so that the final username conforms to the normal username in terms of length; then, it randomly selects a string from the starting structure counter as the initial part of the username. The algorithm creates a character slice from the last n-1 characters of the generated username through an iterative process, and based on this, selects the next character from the intermediate structure counter. Each time a character is selected, it is randomly selected according to the continuation probability weight of the character. The operation of creating character slices and selecting characters from the intermediate structure counter through an iterative process is repeated until the length of the generated username exceeds a target length that conforms to the normal distribution, and the slice hits the end structure counter indicating that the username can end. Then, the pronunciation structure is traversed from large to small, and the generated user names are matched in turn to determine whether the user name meets the pronunciation structure. If not, it is discarded and the generation continues from the initial part. If it fails to meet the requirements three times in a row, the initial part is discarded and a new one is randomly selected to start again; finally, the generated virtual user name that meets the requirements is returned. All generated virtual user names constitute the virtual user name data set.

[0037] The ability of Markov chains to analyze character sequences can be used to understand and simulate the character arrangement patterns in usernames. Taking the second-order Markov chain as an example, this method not only considers the probability of occurrence of a single character, but also further analyzes the conditional probability of each character's occurrence, that is, how it is affected and restricted by the first two characters. This in-depth analysis of the correlation of character sequences gives the generated virtual usernames a structural feature that is highly similar to the initial username dataset. This means that not only are the generated usernames similar to real usernames in terms of visual and linguistic sense, but they also maintain consistent character combination patterns and style characteristics. This makes it difficult to distinguish the true and false information in the generated virtual username dataset from the information in the initial username dataset.

[0038] 102: Generate a honey spot according to the virtual user name data set, and place the honey spot on the set attack path.

[0039] In a possible embodiment, the attack path is set according to the attack strategy of the network attacker to conduct intra-domain attacks. Exemplarily, based on the in-depth understanding of the network attacker's strategy of using usernames to conduct intra-domain attacks, a feasible attack path can be planned. A honey spot system generated according to a virtual username data set is set on the planned attack path. These honey spot systems carry specific usernames, which can not only simulate the real user account environment, but also effectively induce and track the activities of potential attackers. By deploying honey spots on the planned attack path, key information can be captured when the attacker moves along the designed path, while providing valuable time and data for the network security team so that they can identify and respond to these threats in a timely manner, thereby adding an important defense layer to the broader network security architecture. Exemplarily, the attack path can be to first attack common web vulnerabilities, obtain the relevant usernames in the vulnerabilities, and then use them to attack domain control.

[0040] In a specific embodiment, the attack path set is a common attack path of an attacker, that is, obtaining a user name, then forging a login request, judging whether the corresponding user actually exists through a login return packet of the Kerberos protocol, and obtaining the corresponding password hash value.

[0041] In a possible embodiment, a honey spot is generated according to a virtual user name data set and a mirror and IP selected by a user, and the honey spot is placed on a planned attack path.

[0042] In a possible embodiment, when a new user name is added in the domain environment, it is determined whether the virtual user name time set exists in a virtual user name identical to the newly added user name. If the same virtual user name exists, the virtual user name is deleted from the virtual user name data set and the honey spot containing the virtual user name is deleted to avoid misjudgment of attack behavior. For example, when the domain management authority is obtained, when a new user is added in the domain environment, the user name can be directly called and queried for judgment. When the domain management authority is not obtained, the judgment can be performed through user operation.

[0043] S103: Acquire target traffic, parse the target traffic to acquire user name information in the target traffic, and detect attack behavior according to the user name information.

[0044] In a possible embodiment, the target traffic is acquired by monitoring the traffic on a designated network card.

[0045] In a specific embodiment, after obtaining the target traffic, the target traffic is parsed. For example, the key-value pair matching is obtained layer by layer through the scapy package of Python to complete the parsing of the target traffic. The parsed information includes user name information. When the user name information in the parsed traffic is the same as the user name in the generated virtual user name data set, it is determined that there is an attack behavior.

[0046] In a possible embodiment, detecting attack behavior according to the user name information includes: comparing the user name information with a virtual user name data set; and determining that an attack behavior exists when the user name information hits a virtual user name in the virtual user name data set.

[0047] In a possible embodiment, by deeply analyzing the Kerberos protocol in the network traffic and analyzing the interaction pattern of the Kerberos protocol to identify and match traffic features related to attack behaviors, the network environment can be accurately monitored and protected.

[0048] In a possible embodiment, after the attack behavior is detected by the method of the present invention, the method further includes: when the attack behavior is detected, generating alarm information according to the detected attack behavior, and sending the alarm information to a log receiving terminal, the log receiving terminal is used to provide a query for the alarm information. Exemplarily, the log receiving terminal includes systems such as Elasticsearch and Kafka.

[0049] The method for generating account lines in a domain environment provided by the present invention utilizes the ability of Markov chains to analyze character sequences to understand and simulate the character arrangement rules in user names, so that the information in the generated virtual user name data set is highly similar to the initial user name data set. Furthermore, constructing fake accounts through a carefully designed and generated virtual user name data set can attract attackers, which not only effectively reveals and identifies potential attackers and their malicious behaviors, but also tracks the lateral movement paths of attackers within the network. This strategy enables security teams to discover and evaluate potential security threats in advance, and then initiate corresponding defense measures to protect critical data and network assets from infringement. Through this proactive security posture, organizations can not only respond to security incidents in a timely manner, but also enhance their overall network defense capabilities to ensure the integrity and security of systems and data.

[0050] Compared with the prior art, the traffic monitoring applied by the method of the present invention does not rely on the logs generated by the system, but directly monitors the communication data at the network level. Even if the logs are tampered with by attackers or not generated, traffic analysis can still capture abnormal communication patterns and discover potential lateral movements. Moreover, traffic monitoring can provide real-time monitoring and can quickly detect abnormal traffic patterns in the network, including emerging attack methods, so as to promptly discover and respond to lateral movements. Traffic monitoring is based on real-time network data and is not restricted by external intelligence sources. It can instantly detect abnormal activities in the network, including unknown and zero-day attacks. Traffic monitoring can detect abnormal behavior at the network level, such as atypical data traffic or activities during abnormal time periods, thereby making up for the monitoring limitations based on user behavior.

[0051] In addition, the method for generating an account line in a domain environment of the present invention designs a feasible attack path based on the attack behavior and related attack patterns of the user name in the domain environment, such as user enumeration and Kerberoast attack in the domain. The attack path not only takes into account the means of intrusion that the attacker may use the user name, but also pays special attention to each link and step of the attack. In the constructed attack route, honey spots with user name identifiers are cleverly arranged, and these honey spots are intended to induce and track potential attackers. Through such a layout, the actions of attackers can be effectively monitored, and key security intelligence can be collected at the same time, providing support for further strengthening the security protection of the domain environment. In addition, this method also helps to increase the risk of attackers being discovered, thereby increasing the cost and difficulty of their attacks.

[0052] See the instruction manual Figure 2 This embodiment also provides a device for generating an account line in a domain environment, which is used to implement the above method embodiment. The device includes:

[0053] The virtual user name generating unit 201 is used to obtain an initial user name data set, extract structural features of the initial user name data set according to preset parameters, and generate a virtual user name data set similar to the user names in the initial user name data set according to the structural features.

[0054] The honey spot setting unit 202 is used to generate a honey spot according to the virtual user name data set and place the honey spot on a set attack path.

[0055] The detection unit 203 is used to obtain target traffic, parse the target traffic to obtain user name information in the target traffic, and detect attack behavior according to the user name information.

[0056] All relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module, and will not be repeated here.

[0057] In other embodiments of the present application, the present application discloses an electronic device, such as Figure 3 As shown, the electronic device 300 may include: one or more processors 301; a memory 302; a display 303; one or more applications (not shown); and one or more computer programs 304. The above components may be connected via one or more communication buses 305. The one or more computer programs 304 are stored in the above memory and configured to be executed by the one or more processors 301. The one or more computer programs 304 include instructions, which may be used to execute the following: Figure 1 And each step in the corresponding embodiment.

[0058] Through the description of the above implementation methods, technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device and unit described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0059] Each functional unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of software functional units.

[0060] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as flash memory, mobile hard disk, read-only memory, random access memory, disk or optical disk.

[0061] The above is only a specific implementation of the embodiment of the present application, but the protection scope of the embodiment of the present application is not limited thereto, and any changes or replacements within the technical scope disclosed in the embodiment of the present application should be included in the protection scope of the embodiment of the present application. Therefore, the protection scope of the embodiment of the present application should be based on the protection scope of the claims.

Claims

1. A method for generating an account line in a domain environment, characterized in that: include: Acquire an initial user name data set, extract structural features of the initial user name data set according to preset parameters, and generate a virtual user name data set similar to user names in the initial user name data set according to the structural features; Generate a honey spot according to the virtual user name data set, and place the honey spot on a set attack path; Obtain target traffic, parse the target traffic to obtain user name information present in the target traffic, and detect attack behavior according to the user name information.

2. The method according to claim 1, characterized in that Also includes: When an attack behavior is detected, alarm information is generated according to the detected attack behavior, and the alarm information is sent to a log receiving terminal, and the log receiving terminal is used to provide a query for the alarm information.

3. The method according to claim 1, characterized in that: Extracting structural features of the initial user name data set according to preset parameters, and generating a virtual user name data set similar to the user names in the initial user name data set according to the structural features, including: Counting the length of each user name in the initial user name data set, and calculating statistical features and user name character structure; Slice each user name according to the number of states in the preset Markov chain and store them in the preset structure counting table; Counting the slice structure counts in the structure count table and performing smoothing processing to obtain the slice structure frequency, and calculating the continuation probability of the slice structure according to the structure counter; The length of a virtual user name is generated by normal distribution with statistical features as parameters, and characters are selected from the structure count table to construct a virtual user name that meets the length of the virtual user name to obtain a virtual user name data set.

4. The method according to claim 3, characterized in that The structure counting table includes three structure counters; Counting the slice structure counts in the structure count table and performing smoothing processing to obtain the slice structure frequency includes: Traversing the structure count table to count the slice structure count in each structure counter; Subtract the set discount value from each slice structure count to obtain the slice structure frequency of each slice structure.

5. The method according to claim 1, characterized in that The attack path is set according to the attack strategy of the network attacker to carry out the intra-domain attack.

6. The method according to claim 1, characterized in that Detecting attack behavior according to the user name information includes: comparing the username information with the virtual username data set; When the user name information matches a virtual user name in the virtual user name data set, it is determined that an attack behavior exists.

7. A device for generating an account number in a domain environment, characterized in that: The device comprises: A virtual user name generating unit, used to obtain an initial user name data set, extract structural features of the initial user name data set according to preset parameters, and generate a virtual user name data set similar to the user names in the initial user name data set according to the structural features; A honey spot setting unit, used to generate a honey spot according to the virtual user name data set, and place the honey spot on a set attack path; The detection unit is used to obtain target traffic, parse the target traffic to obtain user name information present in the target traffic, and detect attack behavior according to the user name information.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for generating an account line in a domain environment according to any one of claims 1 to 6 is implemented.

9. An electronic device, characterized in that: include: Processor and memory; The memory is used to store computer programs; The processor is used to execute the computer program stored in the memory so that the electronic device executes the method for generating an account line in a domain environment according to any one of claims 1 to 6.

Images