A method for generating a cross-domain account profile

Abstract

The application provides a method for generating an account in a domain environment, comprising: obtaining an initial username data set, extracting structural features of the initial username data set according to preset parameters, generating a virtual username data set similar to the usernames in the initial username data set according to the structural features, generating a honeypot according to the virtual username data set, placing the honeypot on a set attack path, obtaining target traffic, analyzing the target traffic to obtain username information existing in the target traffic, and detecting an attack behavior according to the username information. The method can generate virtual usernames highly similar to real usernames and generate honeypots, can induce and track potential attackers by placing the honeypots on the set attack path, and can accurately detect the attack behavior in a timely manner by analyzing the traffic.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer security, and particularly relates to a method for generating a decoy account in a domain environment. BACKGROUND

[0002] In the field of computer security, methods such as log monitoring, behavioral analysis, threat intelligence, and abnormal access pattern recognition can effectively identify and respond to potential intrusion behaviors.

[0003] These technologies and measures play a crucial role in effectively identifying, preventing, and defending against lateral movement attacks, significantly enhancing the security defenses of organizations. They play a core role in detecting attack patterns, conducting data analysis, and identifying abnormal behaviors, providing comprehensive and multi-level security protection for enterprises.

[0004] However, these methods still have some shortcomings:

[0005] Log monitoring relies on system and application-generated logs. If attackers disable or tamper with logs, or certain systems are not configured to generate detailed logs, this will limit the effectiveness of monitoring. In addition, log monitoring is usually reactive rather than real-time, and the monitoring effectiveness is insufficient.

[0006] Behavioral analysis usually requires a large amount of historical data to establish a baseline of normal behavior, and may not be able to identify new attack patterns. In addition, it can produce a high false positive rate.

[0007] Threat intelligence mainly relies on external information sources, which may cause information delay or not fully match the current network environment. In addition, it is more suitable for identifying known threats, and the identification effect of new attack methods such as zero-day attacks is limited.

[0008] Abnormal access pattern recognition relies on predefined rules or baselines of user behavior, and may not be able to detect access behavior that uses legitimate credentials but in an abnormal way.

[0009] Therefore, it is necessary to provide a method that can accurately detect attack behaviors in a domain environment. SUMMARY

[0010] The purpose of the present application is to provide a method for generating a decoy account in a domain environment, to generate and deploy decoy accounts in a domain environment, thereby forming a new defense layer in a network security architecture to accurately detect attack behaviors in a domain environment.

[0011] The application provides a domain environment account line generation method.

[0012] The domain environment account line generation method has the beneficial effects that the character arrangement rules in the username are understood and simulated by using the analysis capability of the Markov chain on the character sequence, the information in the generated virtual username data set is highly similar to the initial username data set, a practicable attack path is designed, the honeypot with the username identifier is arranged in the attack path to induce and track the potential attacker, the action of the attacker can be effectively monitored, the key security information is collected, the security protection of the domain environment is further strengthened, the attack behavior can be detected in time and accurately by listening to the traffic and performing analysis, and the alarm information is generated according to the detected attack behavior.

[0013] In a possible embodiment, when the attack behavior is detected, alarm information is generated according to the detected attack behavior, and the alarm information is sent to a log receiving terminal, and the log receiving terminal is used to query the alarm information.

[0014] In another possible embodiment, the structure features of the initial username data set are extracted according to the preset parameters, the virtual username data set similar to the username in the initial username data set is generated according to the structure features, and the method comprises the following steps: the length of each username in the initial username data set is counted, and the statistical features and the username character structure are calculated; each username is sliced according to the state quantity in the preset Markov chain, and is stored in a preset structure counter table; the slice structure count in the structure counter table is counted and is smoothed to obtain the slice structure frequency, the continuation probability of the slice structure is calculated according to the structure counter, the virtual username length is generated by the normal distribution with the statistical features as the parameters, the characters are selected from the structure counter table to construct the virtual username with the virtual username length to obtain the virtual username data set.

[0015] The structure counter table comprises three structure counters; the slice structure count in the structure counter table is counted and is smoothed to obtain the slice structure frequency, which comprises the following steps: the structure counter table is traversed to count the slice structure count in each structure counter; each slice structure count is subtracted by a set discount value to obtain the slice structure frequency of each slice structure.

[0016] In other possible embodiments, the set attack path is set according to an attack strategy of a network attacker performing an attack within a domain.

[0017] The attack behavior is detected according to the username information, including: comparing the username information with the virtual username data set; and when the username information hits a virtual username in the virtual username data set, it is determined that there is an attack behavior.

[0018] In a second aspect, the application further provides an account line generation device in a domain environment, including:

[0019] The virtual username generation unit is configured to obtain an initial username data set, extract structural features of the initial username data set according to preset parameters, and generate a virtual username data set similar to usernames in the initial username data set according to the structural features.

[0020] The honeypot setting unit is configured to generate a honeypot according to the virtual username data set and place the honeypot on a set attack path.

[0021] The detection unit is configured to obtain target traffic, parse the target traffic to obtain username information existing in the target traffic, and detect an attack behavior according to the username information.

[0022] In a third aspect, the application further provides a computer readable storage medium, which stores a computer program. When the computer program is executed by a processor, the account line generation method in a domain environment is implemented.

[0023] In a fourth aspect, the application further provides an electronic device, including a processor and a memory. The memory is configured to store a computer program. The processor is configured to execute the computer program stored in the memory, so that the electronic device executes the account line generation method in a domain environment.

[0024] The beneficial effects of the second to fourth aspects can be seen from the description of the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0025] Figure 1 A flowchart of an account line generation method in a domain environment provided by an embodiment of the application is shown in the figure;

[0026] Figure 2 A schematic diagram of an account line generation device in a domain environment provided by an embodiment of the application is shown in the figure;

[0027] Figure 3 A structural schematic diagram of an electronic device provided by an embodiment of the application is shown in the figure. DETAILED DESCRIPTION

[0028] In order to make the objects, technical solutions and advantages of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the present application. Unless otherwise defined, the technical terms or scientific terms used herein should be understood as the common meanings thereof by those of ordinary skill in the art to which the present application belongs. The words such as "comprise" and the like used herein mean that the elements or objects before the words encompass the elements or objects listed after the words and their equivalents, and do not exclude other elements or objects.

[0029] The present embodiment provides a method for generating account numbers in a domain environment. Referring to the accompanying drawings of the specification Figure 1 The method comprises:

[0030] S101: obtaining an initial username data set, extracting structural features of the initial username data set according to preset parameters, and generating a virtual username data set similar to the usernames in the initial username data set according to the structural features.

[0031] In a possible embodiment, the initial username data set can be composed of existing usernames obtained from the domain, or can be a preset data set including a certain number of usernames. Exemplarily, when the method of the present application is applied to generate account numbers in a domain environment, if domain administrator permission is obtained, the existing usernames can be called to obtain the initial username data set; if the domain administrator permission is not obtained, the preset data set including a certain number of usernames is applied as the initial username data set.

[0032] In a possible embodiment, the initial username data set is extracted according to preset parameters, and a virtual username data set similar to the usernames in the initial username data set is generated according to the structural features, which comprises: counting the length of each username in the initial username data set, and calculating the statistical features and the username character structure; slicing each username according to the number of states in the preset Markov chain, and storing it in a preset structure counter table; counting the slice structure count in the structure counter table and performing smoothing processing to obtain the slice structure frequency, and calculating the continuation probability of the slice structure according to the structure counter; generating a virtual username length by normal distribution with the statistical features as parameters, selecting characters from the structure counter table to construct a virtual username with the virtual username length to obtain the virtual username data set.

[0033] In a possible embodiment, three structure counters are included in the structure counting table. The slice structure count in the structure counting table is counted and smoothed to obtain the slice structure frequency, including: traversing the structure counting table to count the slice structure count in each structure counter; subtracting a set discount value from each slice structure count to obtain the slice structure frequency of each slice structure.

[0034] In a specific embodiment, for the initial username data set, each username is traversed, the length of each username is counted, and statistical characteristics such as mean and standard deviation are calculated to obtain the pronunciation structure of each username as a dictionary, which is used to filter valid data in the username. According to the number of states (i.e. the length of the sequence) n in the preset Markov chain, the username sequence is sliced to capture the dependency between elements and context information in the username sequence: that is, for a sequence of length m, 0 to n bits are read, 1 to n+1 bits to m-n bits to m bits, and then the dependency between the nth bit and the previous n-1 bits is constructed according to the slice, and the captured information is stored in the preset structure counting table. In this embodiment, the structure counting table includes a start structure counter, an intermediate structure counter, and an end structure counter. The three structure counters. Among them, 0 to n-1 bits are stored in the start structure counter, m-n+1 bits to m bits are stored in the end structure counter, and the rest are stored in the intermediate structure counter as long as the nth bit in the slice is not empty. Thus, the context structure construction of the Markov chain is completed.

[0035] Traverse the three structure counters to count the count of all slice structures in each counter. Set an initial discount value, and subtract the initial discount value from the count of each slice structure to obtain the final slice structure frequency to prevent overfitting caused by excessively high count. Calculate the continuation probability of the slice structure, i.e. the possibility of its appearance in other contexts as part of a higher-order slice, and combine the slice structure frequency and the continuation probability to calculate the final smoothed continuation probability. Considering that the structures in the initial username data set may have different degrees of sparsity and density, it is necessary to smooth the structure counting table to avoid the model estimating the probability of some structures too low or zero due to their too few or even zero occurrences, especially those structures that have never appeared in the training data.

[0036] The structure count table after smoothing is applied to generate similar usernames. Specifically, with the calculated statistical features (mean and standard deviation) as parameters, a random sentence length conforming to the distribution is generated through normal distribution, and the subsequent generated username length will be close to this length as the target, so that the final username conforms to the normal username in terms of length; then it randomly selects a string from the starting structure counter as the initial part of the username. The algorithm creates a character slice from the last n-1 characters of the generated username through an iterative process, and selects the next character from the middle structure counter based on this. Each time a character is selected, it is randomly selected according to the continuation probability weight of the character. Repeat the operation of creating a character slice through an iterative process and selecting a character from the middle structure counter until the length of the generated username exceeds a target length that follows a normal distribution, and the slice hits the end structure counter indicating that the username can end. Then, traverse the pronunciation structure from large to small, match the generated username one by one to determine if the username meets the pronunciation structure, if not, discard it and continue generating from the initial part, if it does not meet for three times in a row, discard the initial part and randomly select a new start; finally return the generated virtual username that meets the requirements. All generated virtual usernames constitute a virtual username dataset.

[0037] The analysis ability of Markov chain on character sequence can understand and simulate the character arrangement rules in the username. Taking a second-order Markov chain as an example, this method not only considers the appearance probability of a single character, but also further analyzes the conditional probability of each character appearing, that is, how it is influenced and restricted by the previous two characters. This in-depth analysis of the association of character sequence gives the generated virtual username a highly similar structural characteristic to the initial username dataset. This not only means that the generated username is similar to the real username in visual and linguistic sense, but also maintains consistent character combination rules and style characteristics. It can make the information in the generated virtual username dataset indistinguishable from the information in the initial username dataset.

[0038] 102: Generate honeypot according to the virtual username dataset, and place the honeypot on the set attack path.

[0039] In one possible embodiment, the attack path is set according to the attack strategy of the network attacker conducting an intradomain attack. Illustratively, based on a deep understanding of the network attacker's intradomain attack strategy using usernames, a practical attack path can be planned. The honeypot systems generated according to the virtual username dataset are set on the planned attack path, and these honeypot systems have specific usernames, which not only simulate a real user account environment, but also effectively induce and track the activities of potential attackers. By deploying honeypots on the planned attack path, key information can be captured when the attacker acts along the designed path, while providing valuable time and data for the network security team so that they can identify and respond to these threats in a timely manner, thereby adding an important defense layer to the broader network security architecture. Illustratively, the attack path can be to first attack common web vulnerabilities, obtain relevant usernames in the vulnerabilities, and then use them to attack the domain controller.

[0040] In one specific embodiment, the attack path set is the common attack path of the attacker, that is, to obtain usernames, then fake login requests, and determine whether the corresponding user exists by the login return packet of the kerberos protocol, and obtain the corresponding password hash value.

[0041] In one possible embodiment, honeypots are generated according to the virtual username dataset and the user-selected image and IP, and the honeypots are placed on the planned attack path.

[0042] In one possible embodiment, when a new username is added in the domain environment, it is determined whether the virtual username dataset exists in the same virtual username as the new username. When the same virtual username exists, the virtual username is deleted from the virtual username dataset and the honeypot containing the virtual username is deleted, so as to avoid misjudgment of the attack behavior. Illustratively, when the domain administrator permission is obtained, the new user in the domain environment can be directly called to query the username for judgment. When the domain administrator permission is not obtained, the user operation can be executed to perform the judgment.

[0043] S103: Obtain target traffic, parse the target traffic to obtain username information existing in the target traffic, and detect attack behavior according to the username information.

[0044] In one possible embodiment, the target traffic is obtained by listening to the traffic on the specified network card.

[0045] In one specific embodiment, after obtaining the target traffic, the target traffic is parsed. For example, the scapy package of python is used to obtain key-value pairs layer by layer to complete the parsing of the target traffic. The parsed information includes username information, and when the username information in the parsed traffic is the same as the username in the generated virtual username dataset, it is determined that there is an attack behavior.

[0046] In a possible embodiment, the attack behavior is detected according to the username information, including: comparing the username information with the virtual username data set; and determining that the attack behavior exists when the username information hits a virtual username in the virtual username data set.

[0047] In a possible embodiment, by deeply analyzing the Kerberos protocol in the network traffic, the interaction mode of the Kerberos protocol is analyzed to identify and match the traffic features related to the attack behavior, so that the network environment can be accurately monitored and protected.

[0048] In a possible embodiment, after the attack behavior is detected by the method of the present application, the method further includes: when the attack behavior is detected, generating an alarm information according to the detected attack behavior, and sending the alarm information to a log receiving terminal, the log receiving terminal being used for providing query of the alarm information. Exemplarily, the log receiving terminal includes systems such as Elasticsearch and Kafka.

[0049] The domain environment account line generation method provided by the present application uses the analysis ability of Markov chain for character sequence to understand and simulate the character arrangement rule in the username, so that the information in the generated virtual username data set is highly similar to the initial username data set. Further, the false account constructed by the carefully designed virtual username data set can attract attackers, which not only effectively reveals and identifies potential attackers and their malicious behaviors, but also traces the lateral movement path of the attackers in the network. This strategy enables the security team to discover and evaluate potential security threats in advance, and then start corresponding defense measures to protect critical data and network assets from being invaded. Through this proactive security posture, the organization not only can respond to security incidents in time, but also can enhance the overall network defense capability to ensure the integrity and security of the system and data.

[0050] Compared with the prior art, the method of the present application applies traffic monitoring which does not depend on system-generated logs, but directly monitors communication data at the network layer. Even if the logs are tampered with or not generated by the attacker, traffic analysis can still capture abnormal communication patterns and discover potential lateral movement. And traffic monitoring can provide real-time monitoring, which can quickly detect abnormal traffic patterns in the network, including new attack methods, so as to timely discover and respond to lateral movement. Traffic monitoring is based on real-time network data and is not limited by external intelligence sources, which can immediately discover abnormal activities in the network, including unknown and zero-day attacks. Traffic monitoring can detect abnormal behaviors at the network layer, such as atypical data traffic or activities at abnormal times, thereby making up for the limitations of user behavior-based monitoring.

[0051] In addition, the account line generation method in the domain environment of the application is based on the attack behavior of the username in the domain environment and the related attack mode, such as domain user enumeration and Kerberoast attack, and a feasible attack path is designed. The attack path not only considers the intrusion means that the attacker may use the username, but also focuses on each link and step of the attack. In the constructed attack route, the honeypot with the username identifier is arranged skillfully, and the honeypot is used to induce and track potential attackers. Through such layout, the action of the attacker can be effectively monitored, and at the same time, the key security information can be collected to provide support for further strengthening the security protection of the domain environment. In addition, this method can also help to increase the risk of being discovered by the attacker, thereby increasing the cost and difficulty of their attack.

[0052] The accompanying drawings are referred to in the description of the application Figure 2 The embodiment also provides a domain environment account line generation device, which is used to implement the above method embodiment. The device comprises:

[0053] The virtual username generation unit 201 is configured to obtain an initial username data set, extract the structural features of the initial username data set according to a preset parameter, and generate a virtual username data set similar to the usernames in the initial username data set according to the structural features.

[0054] The honeypot setting unit 202 is configured to generate a honeypot according to the virtual username data set and place the honeypot on the set attack path.

[0055] The detection unit 203 is configured to obtain target traffic, parse the target traffic to obtain username information existing in the target traffic, and detect attack behavior according to the username information.

[0056] All related contents of each step involved in the above method embodiment can be referred to the function description of the corresponding function module, and will not be repeated here.

[0057] In some other embodiments of the application, the application embodiment discloses an electronic device, as shown in the figure Figure 3 The electronic device 300 can include one or more processors 301, a memory 302, a display 303, one or more application programs (not shown), and one or more computer programs 304, and the above devices can be connected through one or more communication buses 305. The one or more computer programs 304 are stored in the above memory and are configured to be executed by the one or more processors 301, and the one or more computer programs 304 include instructions that can be used to execute each step in the above Figure 1 and the corresponding embodiments.

[0058] Those skilled in the art can clearly understand the technical solutions of the present application according to the above description of the embodiments, and for the convenience and brevity of description, only the division of the above functional modules is taken as an example, and in actual application, the above functions can be completed by different functional modules according to needs, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device and unit described above can refer to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0059] The functional units in the various embodiments of the present application can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware, or in the form of a software functional unit.

[0060] When the integrated unit is realized in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the embodiments of the present application essentially or in other words the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to execute all or part of the steps of the methods described in the various embodiments of the present application. The foregoing storage medium includes: a flash memory, a mobile hard disk, a read-only memory, a random access memory, a magnetic disk or an optical disk, and various media that can store program codes.

[0061] The above description is only a specific implementation of the embodiments of the present application, but the protection scope of the embodiments of the present application is not limited thereto. Any change or replacement within the technical scope disclosed in the embodiments of the present application should be covered in the protection scope of the embodiments of the present application. Therefore, the protection scope of the embodiments of the present application should be subject to the protection scope of the claims.

Claims

1. A method for generating an account number in a domain environment, characterized in that: include: Acquire an initial user name data set, extract structural features of the initial user name data set according to preset parameters, and generate a virtual user name data set similar to user names in the initial user name data set based on the structural features; generating a honey spot according to the virtual user name data set, and placing the honey spot on a set attack path; Obtain target traffic, parse the target traffic to obtain username information present in the target traffic, and detect attack behavior based on the username information; The step of extracting structural features of the initial user name dataset according to preset parameters and generating a virtual user name dataset similar to user names in the initial user name dataset according to the structural features includes: Counting the length of each username in the initial username data set, and calculating statistical features and username character structure; Slice each username according to the number of states in the preset Markov chain and store them in the preset structure counting table; Counting the slice structure counts in the structure count table and performing smoothing processing to obtain the slice structure frequency, and calculating the continuation probability of the slice structure according to the structure count table; The length of a virtual user name is generated by normal distribution using statistical features as parameters, and characters are selected from the structure count table to construct a virtual user name that meets the length of the virtual user name to obtain a virtual user name data set.

2. The method according to claim 1, characterized in that Also includes: When an attack behavior is detected, alarm information is generated according to the detected attack behavior, and the alarm information is sent to a log receiving terminal, which is used to provide query of the alarm information.

3. The method according to claim 1, characterized in that The structure counting table includes three structure counters; Counting the slice structure counts in the structure count table and performing smoothing processing to obtain the slice structure frequency includes: Traversing the structure counting table to count the slice structure count in each structure counter; Subtract the set discount value from each slice structure count to obtain the slice structure frequency of each slice structure.

4. The method according to claim 1, wherein The attack path is set according to the attack strategy of the network attacker to carry out the intra-domain attack.

5. The method according to claim 1, wherein Detecting attack behavior based on the username information includes: comparing the username information with the virtual username dataset; When the user name information matches a virtual user name in the virtual user name data set, it is determined that an attack behavior exists.

6. A device for generating an account number in a domain environment, characterized in that: The device comprises: a virtual user name generating unit, configured to obtain an initial user name data set, extract structural features of the initial user name data set according to preset parameters, and generate a virtual user name data set similar to user names in the initial user name data set according to the structural features; a honey spot setting unit, configured to generate a honey spot based on the virtual username data set and place the honey spot on a set attack path; a detection unit, configured to obtain target traffic, parse the target traffic to obtain username information present in the target traffic, and detect attack behavior based on the username information; The step of extracting structural features of the initial user name dataset according to preset parameters and generating a virtual user name dataset similar to user names in the initial user name dataset according to the structural features includes: Counting the length of each username in the initial username data set, and calculating statistical features and username character structure; Slice each username according to the number of states in the preset Markov chain and store them in the preset structure counting table; Counting the slice structure counts in the structure count table and performing smoothing processing to obtain the slice structure frequency, and calculating the continuation probability of the slice structure according to the structure count table; The length of a virtual user name is generated by normal distribution using statistical features as parameters, and characters are selected from the structure count table to construct a virtual user name that meets the length of the virtual user name to obtain a virtual user name data set.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for generating an account line in a domain environment according to any one of claims 1 to 5 is implemented.

8. An electronic device, characterized in that: include: processor and memory; The memory is used to store computer programs; The processor is used to execute the computer program stored in the memory, so that the electronic device executes the method for generating an account line in a domain environment according to any one of claims 1 to 5.

Images