Network attack tracing method, device and equipment based on honeypot trapping and medium

Abstract

The invention provides a network attack tracing method and device based on honeypot trapping, equipment and a medium, and the method comprises the steps: inducing an attack source to initiate an attack behavior based on a pre-built honeypot system; in response to the attack behavior, entering the honeypot system, and obtaining clue data in the attack behavior; based on the clue data, performing traceability analysis on the attack source to obtain an analysis result of the attack source; and based on the analysis result, implementing countering measures on the attack source.

Description

Technical Field

[0001] The present disclosure relates to the field of network security, and in particular to a network attack tracing method, device, equipment and storage medium based on honeypot trapping. Background Art

[0002] In the context of global digitalization, the strategic commanding heights of cyberspace security have been rising year by year, cyber attacks have occurred frequently, and cyber attack and defense confrontations have shown a trend of complexity, scale, and organization. The cyber attack tracing technology that locates the source of cyber attack incidents is considered to be an excellent way to anticipate the enemy and reverse the disadvantage under the asymmetric conditions of cyber attack and defense, and has attracted widespread attention. However, the attack scenarios currently studied are mostly non-directional cyber attacks, and the tracking and tracing capabilities are limited when dealing with cyber attacks that frequently use springboard hosts, springboard networks, and public network services. From a technical point of view, the existing tracing methods are mainly passive tracing and tracing technologies, and there is a lack of research on actively obtaining key information for tracing and tracing. The concealment and anonymity of cyber attacks conform to the "barrel principle", so the breakthrough of tracing and tracing often depends on a small number of core key clues. Passive tracing and tracing collects information leaked intentionally or unintentionally by attackers, and the quality of clues is difficult to meet the expectations of the tracing party. Summary of the invention

[0003] 1. Technical issues to be resolved

[0004] In view of the above problems, the present disclosure provides a network attack tracing method, device, equipment and storage medium based on honeypot trapping, so as to at least partially solve the technical problems of limited tracking capability, poor clue quality, and asymmetric attack and defense of existing tracing means.

[0005] (II) Technical solution

[0006] The present disclosure provides a network attack tracing method based on honeypot trapping, comprising: inducing an attack source to initiate an attack behavior based on a pre-built honeypot system; entering the honeypot system in response to the attack behavior, and obtaining clue data in the attack behavior; based on the clue data, tracing the attack source and analyzing the attack source to obtain an analysis result of the attack source; and implementing countermeasures against the attack source based on the analysis result.

[0007] According to an embodiment of the present disclosure, the method of inducing an attack source to initiate an attack based on a pre-built honeypot system includes: simulating a target business system, deploying false data in the honeypot system and simulating interactions, so as to induce the attack source to initiate the attack against the host of the honeypot system.

[0008] According to an embodiment of the present disclosure, in response to the attack behavior entering the honeypot system, obtaining clue data in the attack behavior includes: monitoring all access behaviors entering the honeypot system; when the access behavior performs illegal operations on the honeypot system, identifying the access behavior as the attack behavior, and recording clue data of the attack behavior.

[0009] According to an embodiment of the present disclosure, the method further includes: configuring a hook program in the honeypot system, and inducing the attack source to execute the hook program to obtain the clue data.

[0010] According to an embodiment of the present disclosure, the attack source is traced and analyzed based on the clue data to obtain the analysis result of the attack source, including: cleaning and standardizing the clue data, and converting the clue data into a unified format to obtain standardized data; mapping the standardized data, and entity aligning the mapped standardized data to form a traceability relationship graph; based on the traceability relationship graph, using a pre-trained classifier to automatically mine and analyze the attack source to obtain the analysis result of the attack source.

[0011] According to an embodiment of the present disclosure, before the clue data is cleaned and standardized and the clue data is converted into a unified format to obtain standardized data, the following steps are included: based on the clue data, characterization information of the attack source at each attack stage is mined; and the characterization information is associated with historical related data to obtain the associated clue data.

[0012] According to an embodiment of the present disclosure, the analysis result of the attack source includes at least: the IP address of the attack source, the attack tool, the attack technique, the attack path, and the correlation relationship between different attack behaviors.

[0013] The second aspect of the present disclosure provides a network attack tracing device based on honeypot trapping, including: an induction module, used to induce an attack source to initiate an attack behavior based on a pre-built honeypot system; an acquisition module, used to enter the honeypot system in response to the attack behavior, and obtain clue data in the attack behavior; a tracing module, used to perform a tracing analysis on the attack source based on the clue data to obtain an analysis result of the attack source; and a countermeasure module, used to implement countermeasures on the attack source based on the analysis result.

[0014] The third aspect of the present disclosure provides an electronic device, comprising: one or more processors; a storage device for storing one or more computer programs, and when the one or more programs are executed by the one or more processors, the one or more processors execute the network attack tracing method based on honeypot trapping.

[0015] The fourth aspect of the present disclosure further provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the network attack tracing method based on honeypot trapping.

[0016] (III) Beneficial effects

[0017] The network attack tracing method, device, equipment and storage medium based on honeypot trapping provided by the present invention reverse the information asymmetry of attack and defense confrontation through honeypot technology, capture more valuable attack intelligence, namely clue data, at the lowest cost, and analyze it in combination with network attack tracing technology, so as to grasp the attack means, attack tools, attack strategies and attack intentions of the attack source, which is helpful to take targeted defense measures for important protection targets and realize the tracking and tracing of attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] For a more complete understanding of the present disclosure and its advantages, reference will now be made to the following description taken in conjunction with the accompanying drawings, in which:

[0019] Figure 1 A schematic diagram of the classification of honeypot technology provided by an embodiment of the present disclosure is shown;

[0020] Figure 2 A schematic diagram schematically shows a router sequence from an attacker to a victim provided by an embodiment of the present disclosure;

[0021] Figure 3 The flowchart of the network attack source tracing method based on honeypot trapping provided by the embodiment of the present disclosure is schematically shown;

[0022] Figure 4 A topological diagram of a network attack source tracing method based on honeypot trapping provided by an embodiment of the present disclosure is schematically shown;

[0023] Figure 5 The following schematically shows a schematic diagram of an attack tracing process model based on honeypot trapping provided by an embodiment of the present disclosure;

[0024] Figure 6 The structure block diagram of the network attack source tracing device based on honeypot trapping provided according to an embodiment of the present disclosure is schematically shown;

[0025] Figure 7 The hardware structure diagram of an electronic device is schematically shown. DETAILED DESCRIPTION

[0026] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0027] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0028] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0029] Some block diagrams and / or flow charts are shown in the accompanying drawings. It should be understood that some blocks or combinations thereof in the block diagrams and / or flow charts may be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that these instructions, when executed by the processor, may create a device for implementing the functions / operations described in these block diagrams and / or flow charts.

[0030] Therefore, the technology of the present disclosure can be implemented in the form of hardware and / or software (including firmware, microcode, etc.). In addition, the technology of the present disclosure can take the form of a computer program product on a computer-readable medium storing instructions, which can be used by an instruction execution system or in combination with an instruction execution system. In the context of the present disclosure, a computer-readable medium can be any medium that can contain, store, transmit, propagate, or transmit instructions. For example, a computer-readable medium can include, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, device, or propagation medium. Specific examples of computer-readable media include: magnetic storage devices, such as magnetic tape or hard disk (HDD); optical storage devices, such as compact disk (CD-ROM); memory, such as random access memory (RAM) or flash memory; and / or wired / wireless communication links.

[0031] The inventor has found through research that, among the related technologies, the honeypot technology is the most typical attack deception and trapping technology, which can achieve attack induction and data recording. Especially in network attack and defense confrontation, threat intelligence and source tracing countermeasures based on honeypot deception and trapping have been widely studied. Honeypot trapping technology can effectively reverse the current situation of asymmetric attack and defense, locate the identity of the attacker more actively and accurately, provide more accurate attack source tracing analysis capabilities, and turn passivity into initiative in attack and defense confrontation.

[0032] Specifically, a honeypot is a security resource whose value lies in being scanned, attacked, and compromised. It is an important basis for tracing and countering network attacks. A honeypot can simulate and forge various operating system environments and vulnerability environments, and can also virtually forge various network service environments. It is a network resource library disguised as a real target, and also a trapping environment system for attack information. By analyzing the attack and intrusion data collected in the honeypot system, relevant information about the attacker can be obtained, and then the attacker's attack methods, attack tools, attack strategies, and attack intentions can be mastered, which will help to take targeted defense measures for important protection targets and track and trace the attack. In recent years, a variety of honeypot products have emerged to target various types of network security threats. Such as Figure 1 As shown in the figure, according to the authenticity and degree of interaction of honeypot simulation resources, honeypots can be divided into low-interaction, medium-interaction and high-interaction honeypots. According to the degree of simulation or resource virtualization adopted by honeypots, they can be divided into physical honeypots, virtual honeypots and semi-physical honeypots. According to the deployment form of honeypots, they can generally be divided into honeynets, honey fields, distributed honeypots, honey tags, etc. According to the specific use of honeypots, they can be specifically divided into product honeypots and research honeypots. The purpose of product honeypots is to provide security protection for an enterprise's network, including detecting attacks, preventing damage caused by attacks, and helping administrators to respond to attacks in a timely and correct manner. Generally, product honeypots are easier to deploy and do not require administrators to invest a lot of work. Research honeypots are specifically used to capture and trace hacker attacks. By deploying research honeypots, hacker attacks can be tracked and analyzed, and hacker attack records can be captured to understand the attack tools and attack methods used by attackers, and even the attackers' behaviors can be monitored, so as to grasp their psychological state and other information. Research honeypots require researchers to invest a lot of time and energy in attack monitoring and analysis.

[0033] Network attack source tracing technology refers to the process of tracking the initiator of a network attack by various means, that is, tracking the source of a network attack and tracing the attacker. It has a very positive significance in locating the source of the attack, preventing or suppressing the network attack, providing legal evidence, and deterring the attacker. Each link of a network attack requires network accessibility. For the attack link, a network attack source tracing analysis problem model can be established first. i1 , R i2 , …, Rin Represents attacker A i and the ordered list of routers between the victim V, such as Figure 2 shown. Figure 2 The ordered list of routers in is A i The attack path is defined as the router that participates in the attack packet forwarding and finally delivers it to the victim. For any router R on the attack path, ij , all in router R ij The router between the victim and the ij The pre-list will be in the router R ij The router between the attacker and the ij The purpose of the attack tracking problem is to determine the direct connection to A i A complete list of attack routes and A i Self-information. At present, the mainstream network attack tracing technologies include threat intelligence, deception trapping and Web tracking technology. In addition, network attack tracing and tracing are divided into four levels according to the depth and accuracy of tracing, namely: tracing and tracing attack hosts, tracing and tracing attack control hosts, tracing and tracing attackers, and tracing and tracing attack organizations. On the first layer of tracing and tracing, technical methods at the network packet level are used; on the second layer, internal monitoring, log analysis, network traffic analysis and event response analysis are used; on the third layer, natural language document analysis, chat record analysis, attack code analysis, keyboard information analysis and other technologies are used. Another representative research method is to divide network attack tracing and tracing into five types of problems: false IP tracking, botnet tracking, anonymous network tracking, springboard tracking and local tracking according to different attack scenarios, and summarize the technical methods to solve these five types of problems into four types: packet marking, stream watermarking, logging and penetration testing. Among them, the packet marking method, as a tracing and tracing method at the network packet level, is difficult to deal with complex network attacks represented by advanced persistent threats. Watermarking technology does not require protocol modification and is also applicable to encrypted traffic. It can even be used to track and trace the source of some network attacks that use anonymous networks as a springboard. However, watermarking technology requires the support of a large amount of anonymous network infrastructure, so it is not easy to implement. At the same time, it is also technically difficult to ensure the accuracy of watermark detection. Logging technology is a passive tracing method, which has the problem of limited recorded information and possible tampering by attackers. The penetration test method can provide a key breakthrough in tracing and tracing network attacks, but the technology is difficult and there are doubts about its credibility.

[0034] Therefore, the embodiments of the present disclosure provide a means of active defense against network threats, namely, a network attack tracing method based on honeypot trapping. The method analyzes honeypot technology and network attack tracing technology, and combines traps, entrapment, deception, and software and hardware feature utilization while complying with relevant laws, regulations, and standards, to obtain high-quality key tracing clues on both the target and the attacker.

[0035] like Figure 3 As shown, the flowchart of the network attack tracing method based on honeypot trapping includes S1~S4.

[0036] In operation S1, based on the pre-built honeypot system, the attack source is induced to initiate an attack.

[0037] In operation S2, in response to the attack behavior entering the honeypot system, clue data in the attack behavior is obtained.

[0038] In operation S3, based on the clue data, the attack source is traced and analyzed to obtain an analysis result of the attack source.

[0039] In operation S4, based on the analysis result, countermeasures are implemented on the attack source.

[0040] Specifically, based on honeypot trapping, network attack tracing generally requires building a honeypot simulation environment (i.e., honeypot system) based on the characteristics of the potential target to be trapped, which usually includes a network deception module, an information capture module, an information control block, and a communication control module. Based on the honeypot simulation environment, combined with the network access control strategy, the attack source (attacker A) is attracted. i ) to actively detect or even attack, thereby obtaining attack source tracing intelligence, namely clue data, through the information capture module, and then tracing and analyzing the attack source's attack path and attack payload through the honeypot analysis platform. The specific architecture of network attack tracing based on honeypot trapping is as follows: Figure 4 Finally, countermeasures are implemented based on the results of the source tracing analysis.

[0041] It is understandable that by setting up the honeypot system, potential attackers are induced to make attempts. Once the attack behavior is captured by the honeypot system, the system can immediately respond and trigger the early warning mechanism, providing early warnings for the network security team, so that they have enough time to prepare countermeasures. In addition, based on the results of the traceability analysis, countermeasures can be flexibly formulated, thereby effectively curbing the spread and diffusion of network attacks and forming an effective deterrent and strike against attackers.

[0042] Furthermore, based on the pre-built honeypot system, inducing the attack source to initiate the attack behavior includes: simulating the target business system, deploying false data in the honeypot system and simulating interaction, inducing the attack source to initiate the attack behavior against the host of the honeypot system.

[0043] Specifically, the network deception module of the honeypot system is the core function that enables the honeypot system to be effective. It mainly combines virtualization technology, simulation technology and physical resources to simulate the target business system, such as: disguised services, code comments, digital certificates, web crawler exclusion standards (Robots files), administrator passwords, Secure Shell Protocol (SSH) keys, Virtual Private Network (VPN) keys, email passwords, Address Resolution Protocol (ARP) records, Domain Name System (DNS) records, deploying false sensitive data and simulating interactions to induce attackers to scan, detect and invade honeypot hosts.

[0044] It should be noted that for trapping advanced persistent threat attacks, it is generally necessary to deploy a honeypot with at least medium interaction level to avoid the honeypot becoming ineffective after the disguise is exposed.

[0045] It is understandable that by simulating the target business system, the honeypot system can highly restore the real business scenario, making it difficult for attackers to distinguish between the real and the fake, thereby enhancing the attractiveness of the honeypot system to attackers and prompting attackers to be more inclined to regard the honeypot system as a real attack target, increasing the probability of attack behavior. In addition, deploying false data in the honeypot system can further induce attackers to attempt attacks. At the same time, simulated interactions further increase attackers' trust in the honeypot system.

[0046] Furthermore, in response to the attack behavior entering the honeypot system, obtaining clue data in the attack behavior includes: monitoring all access behaviors entering the honeypot system; when the access behavior performs illegal operations on the honeypot system, identifying the access behavior as the attack behavior, and recording clue data of the attack behavior.

[0047] Specifically, the information capture module is the basic module for tracing network attacks. It mainly monitors and records all behaviors entering the honeypot system, including various network data packets, host logs, operation records, etc. Once illegal operations on the honeypot system are monitored, they are identified as attack behaviors, and relevant record information is immediately generated to record clue data, and its log record information is stored separately.

[0048] Furthermore, the information control module in the honeypot system restricts the attack behaviors entering the honeypot system, thereby ensuring that the attack source will not use the compromised honeypot host as a springboard to infiltrate and attack other systems and cause harm. For example, by using firewalls and routers in conjunction with methods such as limiting the honeypot bandwidth rate, the purpose of information control can be better achieved. In addition, the communication control module immediately reports the attack behavior information recorded by the information capture module, namely the clue data, to the attack event analysis platform, which then conducts in-depth attack source tracing analysis.

[0049] It can be understood that by comprehensively monitoring all access behaviors entering the honeypot system, the system can capture any interactive activities with the honeypot system in real time, ensuring the system's immediate response capability to attack behaviors in order to quickly identify and react.

[0050] In an embodiment of the present disclosure, the method further includes: configuring a hook program in the honeypot system, and inducing the attack source to execute the hook program to obtain the clue data.

[0051] Specifically, in order to obtain more information about the attack source, a hook program can be configured in the honeypot. A hook program is a special code segment that can be triggered and executed when a specific event occurs. In the honeypot system, the hook program can be configured to automatically run when the attack source triggers certain conditions, such as specific file access, network request, system call, etc.

[0052] Exemplarily, the configuration of the hook program first selects appropriate hook points, such as key files, processes, and network ports in the honeypot system, based on the possible behavior patterns of the attacker and the characteristics of the honeypot system. Then, write the corresponding hook program based on the selected hook points. The hook program needs to be able to record the attacker's behavior, capture network traffic, and collect system logs for subsequent analysis. Then deploy the written hook program to the honeypot system and ensure that it can run automatically when the attacker triggers the conditions. Finally, induce the attack source to execute the configured hook program, for example, simulate a vulnerable environment, and set some high-value baits, such as sensitive data, configuration files, etc., to attract attackers to attack and explore.

[0053] It is understandable that by configuring the hook program, the honeypot system can capture the attacker's attack behavior in real time when the attacker triggers specific conditions, so that the attacker's dynamics can be quickly understood, so as to respond in time and obtain more information about the attacker.

[0054] In an embodiment of the present disclosure, before the clue data is cleaned and standardized and the clue data is converted into a unified format to obtain standardized data, the following steps are included: based on the clue data, characterization information of the attack source at each attack stage is mined; and the characterization information is associated with historical related data to obtain the associated clue data.

[0055] like Figure 5 As shown in the figure, the network attack source tracing process can be generally divided into three stages, namely, the honeypot attack data source capture stage, the deep source tracing analysis stage, and the source tracing countermeasure implementation stage. Among them, in the honeypot attack data source capture stage, the clue data left in the attack activities are safely collected to capture the attacker-related threat intelligence, such as known attackers, attacker motives, attack tools, infrastructure, attack methods, attack patterns, involved attack targets, malicious IP addresses, malicious domain names, malicious email addresses, attack tools, vulnerabilities used by attack tools, attack methods, etc. At the same time, combined with the traffic data, alarm logs, host logs / configurations and other data sources of the network attack targets, malicious code analysis, attack tool fingerprints used by attackers, attack IPs, attack domain names, etc., to form the final clue data.

[0056] Exemplarily, network traffic data collection: Use tools such as network packet analysis software to capture data packets and obtain information such as source IP, destination IP, port, protocol type, and data packet content.

[0057] Exemplarily, system log data collection includes: operating system logs (such as Windows event logs, Linux system logs), application logs (such as Web server logs, database logs).

[0058] Exemplarily, process and file activity data collection: monitoring activities such as process creation, file reading and writing, and registry modification in the honeypot system.

[0059] Furthermore, after obtaining the clue data, we focus on mining the characterization information of the attack in various stages such as penetration, delivery, persistence, lateral movement, and theft based on the clue data, such as IP-related geographic location, domain name, execution command, multi-packet load characteristics, and various other operations performed on the host. Then, we conduct correlation analysis on the characterization information with historical related data such as known attackers and historical attack events, and mine the relationship between multi-dimensional data to obtain the correlated clue data, so as to judge the possible attackers or attack organizations.

[0060] It is understandable that by mining the characterization information of the attack source at each attack stage, the behavior patterns and characteristics of the network attack can be fully reflected, so as to formulate more accurate countermeasures. In addition, correlation analysis can enhance the understanding of the background and motivation of the network attack, and provide richer and more comprehensive data support for subsequent tracing work.

[0061] Furthermore, based on the clue data, the attack source is traced and analyzed to obtain the analysis result of the attack source, including: cleaning and standardizing the clue data, and converting the clue data into a unified format to obtain standardized data; mapping the standardized data, and entity aligning the mapped standardized data to form a traceability relationship diagram; based on the traceability relationship diagram, using a pre-trained classifier to automatically mine and analyze the attack source to obtain the analysis result of the attack source.

[0062] Continue to refer to Figure 5 In the deep tracing analysis stage, that is, in the stage of generating the tracing relationship diagram of network attack events, first, the final associated clue data is cleaned and standardized to remove duplicate, invalid and noise data. At the same time, the data of different formats and sources are converted into a unified format to obtain standardized data for subsequent analysis. Then, the mapping can be completed by combining the word vector-based mapping method with the dictionary-based mapping method. The standardized data is then aligned using the string edit distance and string similarity to achieve multi-source heterogeneous data fusion and form a network attack event tracing relationship diagram. Finally, the feature vectors of historical network attack events are used to train the classifier, and the trained classifier is used to automatically mine known attackers / organizations to obtain the analysis results of the attack source.

[0063] It is understandable that data preprocessing helps improve and standardize data quality, while constructing a traceability relationship diagram can provide a clear structure and framework for subsequent traceability analysis. In addition, using pre-trained classifiers to automatically mine and analyze attack sources can significantly improve the efficiency and accuracy of traceability analysis and enable in-depth mining of potential patterns and trends in attack behavior.

[0064] In an embodiment of the present disclosure, the analysis result of the attack source includes at least: the IP address of the attack source, the attack tool, the attack technique, the attack path, and the correlation relationship between different attack behaviors.

[0065] Continue to refer to Figure 5Based on the results of the traceability analysis, the implementation phase of the traceability countermeasure can support the use of attack evidence, attack profiling, continuous attack monitoring, and the formulation of targeted defense strategies. If the attacker realizes that he has fallen into a deception trap, it is a huge psychological deterrent to him. The attacker is under the surveillance of the deception environment for a long time, and the defender has sufficient time and space to deploy tools and set up organs to carry out network attack tracking and tracing, thereby forming countermeasures and deterrence.

[0066] Furthermore, the analysis result of the attack source includes at least: the IP address of the attack source, the attack tool, the attack technique, the attack path, and the correlation between different attack behaviors.

[0067] For example, the attacker's IP address is traced. Geographic location: Use databases such as MaxMind to determine the attacker's approximate geographic location based on the IP address. Internet Service Provider (ISP) query: Obtain the ISP information to which the IP belongs by cooperating with the ISP or using public databases.

[0068] For example, the analysis is focused on attack tools and techniques. Static analysis in malware analysis: Use disassembly tools to disassemble and analyze the binary code of malware to extract information such as signatures, function calls, and strings. Dynamic analysis in malware analysis: Run malware in a sandbox environment to observe its behavior, network connections, file operations, etc. Vulnerability exploitation analysis: Determine the type of vulnerability and exploitation method used by the attacker through analysis of system logs and traffic.

[0069] For example, the attack path is reconstructed. Time series-based analysis: sort out the attacker's operation steps and sequence according to the time sequence of events. Network connection analysis: by analyzing the source and destination IP and port in the data packet, build the attacker's connection map in the network.

[0070] For example, for correlation analysis. Correlation with the internal threat intelligence library: Compare the collected attack features with the threat intelligence accumulated within the enterprise to find out whether there are matching attackers or attack patterns. Correlation with the external threat intelligence platform: Get more information about attack tools, IP, etc.

[0071] In some exemplary embodiments, the association rule data mining algorithm Apriori is used to discover the association relationship between different attack behaviors. In the implementation process of using the Apriori algorithm, the related concepts are first defined. Let the data set D be the set of all transactions, and transaction T is an element in the data set D, that is, a record of an attack behavior. The item set I is a set of some attack behavior features, such as a specific IP access mode, the type of attack tool used, etc. Then, the support (Support) is calculated. The support (X) represents the frequency of the item set X appearing in the data set D, which is expressed as follows:

[0072]

[0073] in, represents the number of transactions containing item set X, and |D| represents the total number of transactions in data set D.

[0074] Then, to generate frequent item sets, first, set a minimum support threshold min_support. By scanning the data set D, find all 1-item sets that satisfy the support greater than or equal to min_support, denoted as L1. Then, through self-join and pruning operations, generate candidate 2-item sets C2. Scan the data set D again, calculate the support of each item set in C2, and obtain the frequent 2-item set L2 that meets the conditions.

[0075] By analogy, through L k-1 Self-join to generate candidate k-item sets C k , calculate the support to get the frequent k-item set L k , until no new frequent itemsets can be generated.

[0076] Finally, association rules are generated and screened. For a frequent item set L, if the subsets of L are X and Y (X∪Y=L), then association rules can be generated. .

[0077] The confidence of the association rule is expressed by mathematical formula:

[0078]

[0079] Set a minimum confidence threshold min_confidence to filter out association rules that satisfy a confidence greater than or equal to min_confidence.

[0080] For example, in the attack behavior dataset collected by the honeypot, there is an item set , after calculation, its support is greater than min_support and is identified as a frequent item set. Then association rules can be generated If its confidence is greater than min_confidence, it means that when the access behavior of IP_1_Access occurs, the attack tool Malware_Tool_1_Use is likely to be used.

[0081] Through the implementation process of the above Apriori algorithm, valuable correlation relationships can be discovered from the large amount of complex clue data collected by the honeypot, providing important clues and basis for network tracing attacks.

[0082] The network attack source tracing method based on honeypot trapping provided by the embodiment of the present disclosure realizes that in the situation where network confrontation continues to escalate, network attackers can be trapped by using honeypot technology, which has obvious functions and advantages in network attack tracking and tracing, to achieve source tracing and countermeasures against attack behaviors, thereby achieving the purpose of deterring attackers and completely cutting off the source of attack.

[0083] Based on the above-mentioned network attack tracing method based on honeypot trapping, the present disclosure also provides a network attack tracing device based on honeypot trapping. Figure 6 The device is described in detail.

[0084] like Figure 6 As shown, the network attack tracing device 300 based on honeypot trapping in this embodiment includes an induction module 601 , an acquisition module 602 , a tracing module 603 and a countermeasure module 604 .

[0085] The induction module 601 is used to induce the attack source to initiate attack behavior based on the pre-built honeypot system.

[0086] The acquisition module 602 is used for entering the honeypot system in response to the attack behavior, and acquiring clue data in the attack behavior.

[0087] The source tracing module 603 is used to perform source tracing analysis on the attack source based on the clue data to obtain the analysis result of the attack source.

[0088] The countermeasure module 604 is used to implement countermeasures on the attack source based on the analysis result.

[0089] It is understandable that the induction module 601, the acquisition module 602, the traceability module 603 and the countermeasure module 604 can be combined in one module, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present invention, at least one of the induction module 601, the acquisition module 602, the traceability module 603 and the countermeasure module 604 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented in hardware or firmware in any other reasonable way of integrating or packaging the circuit, or in a proper combination of software, hardware and firmware. Alternatively, at least one of the induction module 601, the acquisition module 602, the traceability module 603 and the countermeasure module 604 can be at least partially implemented as a computer program module, and when the program is run by a computer, the function of the corresponding module can be executed.

[0090] Figure 7 The structural block diagram of an electronic device provided by an embodiment of the present disclosure is schematically shown.

[0091] like Figure 7 As shown, the electronic device described in this embodiment includes: the electronic device 700 includes a processor 710 and a computer readable storage medium 720. The electronic device 700 can execute the above reference Figure 3 Describes the method to achieve detection of specific operations.

[0092] Specifically, the processor 710 may include, for example, a general-purpose microprocessor, an instruction set processor and / or a related chipset and / or a dedicated microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 710 may also include an onboard memory for cache purposes. The processor 710 may be a processor for executing reference Figure 3 The described method flow according to the embodiment of the present disclosure may be a single processing unit or multiple processing units for different actions.

[0093] Computer readable storage medium 720, for example, can be any medium capable of containing, storing, conveying, propagating or transmitting instructions. For example, readable storage media can include, but are not limited to, electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices, devices or propagation media. Specific examples of readable storage media include: magnetic storage devices, such as magnetic tapes or hard disks (HDDs); optical storage devices, such as compact disks (CD-ROMs); memory, such as random access memory (RAM) or flash memory; and / or wired / wireless communication links.

[0094] The computer readable storage medium 720 may include a computer program 721, which may include code / computer executable instructions, which when executed by the processor 710 causes the processor 710 to perform, for example, the above-mentioned combination Figure 3 The described method sequences and any variations thereof.

[0095] The computer program 721 may be configured to have, for example, computer program codes including computer program modules. For example, in an exemplary embodiment, the codes in the computer program 721 may include one or more program modules, for example, including 721A, module 721B, ... It should be noted that the division method and number of modules are not fixed, and those skilled in the art may use appropriate program modules or program module combinations according to actual conditions. When these program module combinations are executed by the processor 710, the processor 710 may execute, for example, the above combination of Figure 3~Figure 5 The described method sequences and any variations thereof.

[0096] According to an embodiment of the present disclosure, at least one of the induction module 601, the acquisition module 602, the tracing module 603 and the countermeasure module 604 can be implemented as a reference. Figure 7 The computer program modules described herein, when executed by the processor 710, can implement the corresponding operations described above.

[0097] The present disclosure also provides a computer-readable medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0098] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0099] Although the present disclosure has been shown and described with reference to specific exemplary embodiments of the present disclosure, it should be understood by those skilled in the art that various changes in form and details may be made to the present disclosure without departing from the spirit and scope of the present disclosure as defined by the appended claims and their equivalents. Therefore, the scope of the present disclosure should not be limited to the above-mentioned embodiments, but should be determined not only by the appended claims, but also by the equivalents of the appended claims.

Claims

1. A network attack tracing method based on honeypot trapping, characterized in that: The method comprises: Based on the pre-built honeypot system, the attack source is induced to launch attack behaviors; In response to the attack behavior entering the honeypot system, obtaining clue data in the attack behavior; Based on the clue data, tracing the attack source is analyzed to obtain the analysis result of the attack source; Based on the analysis result, countermeasures are implemented on the attack source.

2. The network attack source tracing method based on honeypot trapping according to claim 1 is characterized in that: The aforementioned inducing attack source to initiate attack behaviors based on the pre-built honeypot system includes: The target business system is simulated, and false data is deployed in the honeypot system to simulate interaction, so as to induce the attack source to launch the attack behavior on the host of the honeypot system.

3. The network attack source tracing method based on honeypot trapping according to claim 1 is characterized in that: In response to the attack behavior entering the honeypot system, obtaining clue data in the attack behavior includes: Monitor all access behaviors entering the honeypot system; When the access behavior performs illegal operations on the honeypot system, the access behavior is identified as the attack behavior, and clue data of the attack behavior is recorded.

4. The network attack source tracing method based on honeypot trapping according to claim 1 is characterized in that: The method further comprises: A hook program is configured in the honeypot system, and the attack source is induced to execute the hook program to obtain the clue data.

5. The network attack source tracing method based on honeypot trapping according to claim 1 is characterized in that: The tracing and analyzing of the attack source based on the clue data to obtain the analysis result of the attack source includes: Performing data cleaning and standardization processing on the clue data, and converting the clue data into a unified format to obtain standardized data; Mapping the standardized data, and performing entity alignment on the mapped standardized data to form a traceability relationship diagram; Based on the traceability relationship diagram, the attack source is automatically mined and analyzed using a pre-trained classifier to obtain an analysis result of the attack source.

6. The network attack source tracing method based on honeypot trapping according to claim 5 is characterized in that: Before the clue data is cleaned and standardized, and the clue data is converted into a unified format to obtain standardized data, the following steps are included: Based on the clue data, mining the representation information of the attack source at each attack stage; The representation information is associated with the historical related data to obtain the associated clue data.

7. The network attack source tracing method based on honeypot trapping according to claim 1 is characterized in that: The analysis result of the attack source includes at least: the IP address of the attack source, the attack tool, the attack technique, the attack path and the correlation relationship between different attack behaviors.

8. A network attack source tracing device based on honeypot trapping, characterized in that: The device comprises: The induction module is used to induce the attack source to launch attack behaviors based on the pre-built honeypot system; An acquisition module, configured to enter the honeypot system in response to the attack behavior and acquire clue data in the attack behavior; A source tracing module, used to perform source tracing analysis on the attack source based on the clue data to obtain an analysis result of the attack source; A countermeasure module is used to implement countermeasures on the attack source based on the analysis result.

9. An electronic device, comprising: one or more processors; a storage device for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images