Internal network threat hunting method and system, storage medium and electronic equipment

Abstract

The invention provides an internal network threat hunting method and system, a storage medium and electronic equipment, and the system comprises a honey mark which is used for recording the node information of a honey treading node when an attacker triggers the honey mark on a node; the early warning module is used for forwarding the early warning information to the delivery module; the delivery module is used for calling the honey hole program corresponding to the early warning information from the load library, and sending the honey hole program and the position information of the honey treading node to a management component in the cloud native cluster, so that the management component sends the honey hole program to the honey treading node according to the position information, and the honey treading node receives and operates the honey hole program; the correlation analysis module is used for receiving and analyzing the operation information returned by the honey hole program and generating an attack path of the threat hunting according to the operation information; and the load library is used for storing various honey hole programs. According to the method, the attack path about threat hunting can be perceived and generated in time, and the account of a cloud cluster administrator can be effectively prevented from being lost.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an internal network threat hunting method, system, storage medium and electronic device. Background Art

[0002] With the development of cloud computing technology, enterprises or organizations have gradually realized the advantages of migrating IT resources to the cloud. Cloud computing provides enterprises with on-demand resources without the need to invest in expensive hardware and infrastructure. As a cutting-edge technology in cloud computing, cloud-native architecture aims to leverage the elasticity and scalability of cloud environments to achieve collaboration in software development and operations. With the popularity of cloud-native architecture and applications, advanced cyber threat actors have targeted cloud devices. After invading the local internal network of an enterprise / organization, threat actors will look for locally stored cloud credentials and try to use terminal devices on the local internal network to access cloud hosts to establish a foothold in the cloud. They will then conduct large-scale lateral movement by scanning and detecting the vulnerabilities of cloud hosts, thereby achieving larger-scale and deeper information theft and sabotage activities.

[0003] At present, security technologies for cloud-native applications are mainly divided into two categories: focusing on container security and focusing on access control policies. The main goal of technologies focusing on container security is to ensure the security within the container, such as detecting whether the container image has known vulnerabilities, malware or incorrect configuration, and whether there is malicious behavior when the container is running; technologies focusing on access control policies ensure that each user and service account can only access the required resources through fine-grained control of API access rights, reducing the risk of abuse of permissions.

[0004] In cloud platforms / cloud hosts, threat actors are more likely to use stolen / compromised cloud credentials to establish an initial foothold and use existing operation and maintenance tools in the foothold host to conduct reconnaissance and lateral movement, which is the same as benign users in terms of behavior. The goal of threat actors is to move laterally to more hosts until they obtain cluster administrator privileges, rather than to conduct sabotage activities within a single cloud host node. Existing security technologies for cloud-native scenarios focus on the security within a single cloud host node (container) and the security of the container image, but do not focus on abnormal behaviors (e.g., lateral movement) between multiple nodes in a cloud cluster; and existing access control policies can only reduce insecure permission configurations, but cannot perceive and deny access to attackers holding legitimate credentials. This makes it impossible for existing security technologies to timely perceive and hunt threat behaviors and attack paths of threat actors in cloud-native scenarios in real time. The inequality of the offensive and defensive technologies will eventually lead to the loss of cloud cluster administrator accounts and the loss of the entire cloud cluster. Summary of the invention

[0005] The purpose of the present invention is to provide an internal network threat hunting method, system, storage medium and electronic device, aiming to solve the problem that traditional security technology is unable to timely perceive and hunt the threat behavior and attack path of threat actors in cloud native scenarios in real time, resulting in the loss of cloud cluster administrator accounts and thus the loss of the entire cloud cluster.

[0006] In a first aspect, the present invention provides an internal network threat hunting system, which is applied to a cloud native cluster, and the system includes:

[0007] Honeytags are deployed on independent nodes or business nodes of the cloud native cluster. When an attacker triggers a honeytag on a node, the attacker records the node information of the honeytag node and sends an early warning message to the early warning module based on the node information.

[0008] The early warning module is used to forward the early warning information to the delivery module;

[0009] The delivery module is used to retrieve the honeyhole program corresponding to the warning information from the load library, and send the location information of the honeyhole program and the honey-stepping node to the management component in the cloud native cluster, so that the management component sends the honeyhole program to the honey-stepping node according to the location information, and the honey-stepping node receives and runs the honeyhole program;

[0010] The correlation analysis module is used to receive and analyze the operation information returned by the honeyhole program, and generate the attack path of this threat hunting based on the operation information;

[0011] The payload library is used to store various honeyhole programs.

[0012] Furthermore, the warning information includes system type, version, architecture, location of the honey node, network location of the triggered honey, and attacker network information.

[0013] Further, the honeymark is a simulated Web server, database server, file server, or a simulated service and port, or a file, database entry, key, password deployed on a normal business node, or a forged VPN configuration file;

[0014] When the honeybean simulates multiple services or opens multiple ports, the warning information also includes the services or ports accessed by the attacker;

[0015] When the honeytoken is a file-type honeytoken, the warning information also includes the path of the specific file or resource accessed by the attacker.

[0016] Furthermore, the delivery module is used to retrieve a matching honeyhole program from a load library according to the system type, version and architecture.

[0017] Furthermore, the operation information includes log information of the honey node, historical operation records, component logs of the cluster, and historical records of the gateway.

[0018] Furthermore, the association analysis module is also used for:

[0019] According to the log information, historical operation records, cluster component logs, and gateway history records of the honey node, find out whether the honey node has access behavior from other nodes;

[0020] If the honey-stepping node has access behaviors from other nodes, then the other node is also marked as a honey-stepping node, and the honeyhole program delivery and association analysis process is repeated for the newly marked honey-stepping node to determine whether the newly marked honey-stepping node has access behaviors from other nodes. This process is repeated until the newly marked honey-stepping node has no access behaviors from other nodes. At this time, the other node is defined as the initial foothold;

[0021] If the first node that delivers the honeyhole program has no access from other nodes, the node that delivers the honeyhole program is marked as the initial foothold;

[0022] The link consisting of all honey-stepping nodes from the first honey-stepping node to which the honeyhole program is delivered to the initial foothold serves as the attack path for this threat hunting.

[0023] In a second aspect, the present invention provides an internal network threat hunting method, which is applied to a cloud native cluster, and the method includes:

[0024] When an attacker triggers a honeytag on a node, the node information of the honeytag node is recorded, and an early warning message is sent based on the node information;

[0025] Forward the warning information;

[0026] Retrieving the honeyhole program corresponding to the warning information from the load library, and sending the honeyhole program and the location information of the honeyhole node to the management component in the cloud native cluster, so that the management component sends the honeyhole program to the honeyhole node according to the location information, and the honeyhole node receives and runs the honeyhole program, wherein the load library stores a variety of honeyhole programs;

[0027] Receive and analyze the running information returned by the honeyhole program, and generate the attack path for this threat hunting based on the running information.

[0028] Furthermore, the step of receiving and analyzing the operation information returned by the honeyhole program, and generating the attack path of this threat hunting according to the operation information includes:

[0029] According to the log information, historical operation records, cluster component logs, and gateway history records of the honey node, find out whether the honey node has access behavior from other nodes;

[0030] If the honey-stepping node has access behaviors from other nodes, then the other node is also marked as a honey-stepping node, and the honeyhole program delivery and association analysis process is repeated for the newly marked honey-stepping node to determine whether the newly marked honey-stepping node has access behaviors from other nodes. This process is repeated until the newly marked honey-stepping node has no access behaviors from other nodes. At this time, the other node is defined as the initial foothold;

[0031] If the first node that delivers the honeyhole program has no access from other nodes, the node that delivers the honeyhole program is marked as the initial foothold;

[0032] The link consisting of all honey-stepping nodes from the first honey-stepping node to which the honeyhole program is delivered to the initial foothold serves as the attack path for this threat hunting.

[0033] In a third aspect, the present invention provides a storage medium storing one or more programs, which implement the above-mentioned internal network threat hunting method when executed by a processor.

[0034] In a fourth aspect, the present invention provides an electronic device, the electronic device comprising a memory and a processor, wherein:

[0035] The memory is used to store computer programs;

[0036] When the processor is used to execute the computer program stored in the memory, the above-mentioned internal network threat hunting method is implemented.

[0037] Compared with the prior art, the present invention has the following advantages:

[0038] 1. According to the above-mentioned internal network threat hunting system, when an attack is taking place in a cloud native cluster, a large number of honey tags are deployed in the cloud cluster to detect whether there are threat actors entering the cloud; benign users and system administrators will only access / operate components and files related to their business, and will not access / operate honey tags, while threat actors cannot accurately identify and avoid contacting all honey tags. After the threat actor steps on the honey tags, the honey tags will record the node where the stepping on the honey tags occurs. Subsequently, the management component is used to deliver the honey hole program to the node, and the honey hole program is used to obtain the system characteristics, device characteristics, network characteristics, environmental characteristics and other information of the suspicious node. The collected information is analyzed and the access log is correlated to determine whether the node is the initial access point of the threat actor on the cloud. Specifically, according to the access information, it is analyzed whether the suspicious node is associated with other suspicious nodes; if so, the honey hole program is continuously delivered to other nodes, and the above process is repeated; if not, the node is the initial foothold of the threat actor, so as to timely perceive and generate the attack path for threat hunting, which can effectively avoid the loss of the cloud cluster administrator account.

[0039] 2. The present invention proposes to detect threat actors entering the cloud native environment through honey beacons when a network threat attack occurs, and use cloud native cluster management components to deliver a honey hole program for information collection to suspicious honey nodes. The program collects the device information, network information, account information, and service information of the honey nodes and transmits it back to the threat hunting system. The threat actor is unaware of this process, and the threat hunting system uses the control over the cluster to complete the real-time capture of the threat before it achieves its attack target; after detecting the threat actor, the present invention collects the most authentic attack scene information through active detection, and associates it with the information recorded in the log system for analysis, and restores the attacker's attack path during detection. Compared with the existing cloud security technology that focuses on the security issues of a single node, the present invention can obtain more detailed, accurate, and macro threat intelligence. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 A schematic diagram of the structure of an internal network threat hunting system proposed in one embodiment of the present invention;

[0041] Figure 2 The diagram is a schematic diagram of the operation of an internal network threat hunting system according to an example of an embodiment of the present invention.

[0042] The following specific implementation manner will further illustrate the present invention in conjunction with the above-mentioned drawings. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be understood by people with general skills in the field to which the present invention belongs. "Including" and similar words used in this article mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0044] See also Figure 1 An embodiment of the present invention provides an internal network threat hunting system, which is composed of a honeymark, an early warning module, a delivery module, a correlation analysis module, a payload library, etc., wherein:

[0045] The honeybean is deployed on an independent node or business node of the cloud native cluster. When an attacker triggers the honeybean on a node, it records the node information of the honeybean node and sends an early warning message to the early warning module based on the node information.

[0046] In some embodiments, a honeytag is a specific bait used to attract the attention of an attacker and induce the attacker to attack, access or manipulate the honeytag. A honeytag can be an independent node deployed in a kubernetes cluster, which builds a simulated environment to simulate the real business system of an enterprise. It can attract and confuse attackers, making them think that they have entered a legitimate production environment. For example, simulated web servers, database servers, file servers, etc., attackers can interact with these applications; for another example, simulated common services and ports, such as HTTP, FTP, SSH, SQL, etc., are used to attract attackers to perform port scans or attempt to exploit service vulnerabilities. A honeytag can also be a file, database entry, key or password deployed on a normal business node. For example, a honeytag can be a forged sensitive file containing access tool information that a system administrator needs to use; for another example, a honeytag can be a forged VPN configuration file containing the VPN product type and version required to access other devices. When an attacker uses these honeytag files and honeytag credentials, the corresponding parsing processing module will identify it as a honeytag and trigger the threat hunting system.

[0047] It should also be noted that the content contained in the warning information and the node information is basically the same. The difference is that the warning information has an additional prompt message that the honey node is attacked. In addition, the warning information also includes the system type, version, architecture, location of the honey node, the network location of the triggered honey, and the attacker's network information.

[0048] In some embodiments, the warning information also includes one or more of the following information, which can help the traceability system deliver the honeyhole program to the honey node and also help sort out and record the scene where the threat was first discovered:

[0049] 1. Network location: Honeybees are deployed in different locations of the network (such as subnets, DMZs, and internal networks), and will record the network location from which the attacker accessed the honeybee. This helps determine whether the attacker entered directly from the outside or has moved laterally in the internal network.

[0050] 2. Service or port trigger point: If the honeybean simulates multiple services or opens multiple ports (such as SSH, HTTP, SMB, etc.), the system will record which service or port the attacker accessed. By analyzing the type of service accessed, the attacker's target type or attack motivation can be inferred.

[0051] 3. File or resource trigger point: In a file-based honeytag (such as a fake document or database), the honeytag will record the path of the specific file or resource accessed by the attacker. This helps understand what sensitive information or resources the attacker is trying to access in the system.

[0052] 4. Trigger location of bait data: If the honey tag contains bait data (such as a fake password or API key), when the attacker accesses or steals this data, the system will record the specific location where the data is triggered

[0053] 5. Attacker network-related content: attacker's IP address - used to identify the attacker's source; network traffic - records all communications with the honey, including protocol type (such as TCP / UDP), port, traffic size, packet content, and timestamp of the honey.

[0054] The warning module is used to receive warning information from the honey target, which includes the system type, version and architecture of the honey node. This information is related to the honeyhole program that will be delivered to the warning node for operation. The warning module then informs the delivery module of this information.

[0055] The delivery module is used to retrieve the honeyhole program corresponding to the warning information from the payload library, that is, to retrieve the matching honeyhole program from the payload library according to the system type, version and architecture, and send the location information of the honeyhole program and the honey-stepping node to the management component in the cloud native cluster, so that the management component sends the honeyhole program to the honey-stepping node according to the location information, and enables the honey-stepping node to receive and run the honeyhole program. In some embodiments, the management component of the cloud cluster is used to enable administrators to remotely manage and automate the nodes / instances running in the operation and maintenance cluster; for example, Ansible is an agentless configuration management tool that allows administrators to use playbooks to automate code execution and deployment tasks on remote instances. By connecting to the target instance through SSH, Ansible can push scripts and applications and execute tasks; for another example, SaltStack is a flexible remote execution tool that supports the management of large-scale cloud instances. It can execute commands and scripts in instances by pushing tasks, supports parallel execution, and is suitable for code deployment and management of large-scale cloud clusters.

[0056] The association analysis module is used to receive and analyze the operation information transmitted back by the honeyhole program, and generate the attack path of this threat hunting based on the operation information. In some embodiments, the association analysis module receives and analyzes the operation information transmitted back by the honeyhole program, and finds out whether the honey-stepping node has access behaviors from other nodes based on the log information, historical operation records, log components of the cluster, historical records of the gateway, etc. of the honey-stepping node; if so, the node is also marked as a honey-stepping node, and the honeyhole program delivery and association analysis process is repeated; if not, the honey-stepping node is regarded as the initial foothold of the threat, and the link composed of all honey-stepping nodes from the first honey-stepping node to which the honeyhole program is delivered to the initial foothold is output as the attack path of this threat hunting. Specifically, the process of generating the attack path of threat hunting is as follows:

[0057] (1) Based on the log information, historical operation records of the honey-stepping node, the component logs of the cluster, and the historical records of the gateway, find out whether the honey-stepping node has access behavior from other nodes;

[0058] (2) If the honey-stepping node has access behaviors from other nodes, then the other node is also marked as a honey-stepping node, and the honeyhole program delivery and association analysis process is repeated for the newly marked honey-stepping node to determine whether the newly marked honey-stepping node has access behaviors from other nodes. This process is repeated until the newly marked honey-stepping node has no access behaviors from other nodes. At this time, the other node is defined as the initial foothold;

[0059] (3) If the first node that delivers the honeyhole program has no access from other nodes, the node that delivers the honeyhole program is marked as the initial foothold;

[0060] (4) The link consisting of all the honey-stepping nodes from the first honey-stepping node to which the honeyhole program is delivered to the initial foothold serves as the attack path for this threat hunting.

[0061] The payload library contains various types of honeyhole programs. Honeyhole programs can be executable script files or executable programs. They collect device information, network information, account information, service information, etc. of the attacker's device, such as device model, MAC address, IP address, operating system information, network environment, device user name, related credential storage, installed / started services, running programs, historical operation records, etc. This information can be used to trace the attack source of suspicious targets. The honeyhole program transmits this information back to the threat hunting system.

[0062] For example, Figure 2 As shown in the figure, an example of the operation of the internal network threat hunting system for cloud native scenarios is listed, showing how the threat hunting system operates when an attacker triggers the honeymark in the cloud native cluster. This example only focuses on the operation process of the threat hunting system. The implementation details such as the program delivery method of the appropriate k8s cluster and the information content collected by the honeyhole program can be adjusted according to specific needs. Figure 2 In the example above, the threat hunting system operates as follows:

[0063] (1) The attacker triggers the honeytag in the node Pod1, which transmits container information such as Pod1 being compromised and the operating system installed on Pod1 being the x86-based Linux system to the threat hunting system;

[0064] (2) The threat hunting system (delivery module) prepares the corresponding x86 architecture-ELF format honeyhole program, and informs the cluster management component of the location of the honeyhole program and the honey node Pod1. The cluster management component informs the kubelet component of the honey node Pod1 through kubectl, so that it receives and runs the honeyhole program from the threat hunting system;

[0065] (3) The honeyhole program runs on node Pod1, collects information such as the programs running on Pod1, real-time system logs and application logs, and historical operation records, and transmits them back to the correlation analysis module;

[0066] (4) When analyzing the returned information, the association analysis module finds that the SSH log of the Pod1 node shows that the current user's access connection comes from the node Pod6, and the connection request from Pod6 to Pod1 is also found in the records of the cluster log component; therefore, Pod6 is marked as a honey-stepping node and the warning module is notified;

[0067] (5) The early warning module finds that the operating system installed on Pod6 is a Windows system with an x86 architecture, so a Powershell script file is delivered and run as a honeyhole program using a method similar to step 2;

[0068] (6) The Powershell script delivered to the Pod6 node runs and collects information such as the programs running on Pod6, real-time system logs and application logs, and historical operation records, and transmits it back to the correlation analysis module;

[0069] (7) The correlation analysis module did not find any other remote access behaviors from internal nodes in the returned logs. At the same time, it was found in the cluster's API gateway that the access to Pod6 used VPN, that is, this access came from outside the cluster. Therefore, Pod6 is regarded as the initial foothold for network threats to enter the cluster; Pod6→Pod1 and related information are output as the attack path.

[0070] In summary, according to the above-mentioned internal network threat hunting system, internal threat hunting specifically for cloud native scenarios is used to detect whether there are threat actors entering the cloud by deploying a large number of honey tags in the cloud cluster; benign users and system administrators will only access / operate components and files related to their business, and will not access / operate honey tags, while threat actors cannot accurately identify and avoid contacting all honey tags. After the threat actor steps on the honey tags, the honey tags will record the node where the stepping on the honey tags occurs. Then, the management component is used to deliver the honey hole program to the node, and the honey hole program is used to obtain the system characteristics, device characteristics, network characteristics, environmental characteristics and other information of the suspicious node. The collected information is analyzed and the access log is correlated to determine whether the node is the initial access point of the threat actor on the cloud. Specifically, according to the access information, it is analyzed whether the suspicious node is associated with other suspicious nodes; if so, the honey hole program is continuously delivered to other nodes, and the above process is repeated; if not, the node is the initial foothold of the threat actor, so as to timely perceive and generate the attack path for threat hunting, which can effectively avoid the loss of the cloud cluster administrator account.

[0071] An embodiment of the present invention further provides an internal network threat hunting method, which is applied to a cloud native cluster. The method includes:

[0072] When an attacker triggers a honeytag on a node, the node information of the honeytag node is recorded, and an early warning message is sent based on the node information;

[0073] Forward the warning information;

[0074] Retrieving the honeyhole program corresponding to the warning information from the load library, and sending the honeyhole program and the location information of the honeyhole node to the management component in the cloud native cluster, so that the management component sends the honeyhole program to the honeyhole node according to the location information, and the honeyhole node receives and runs the honeyhole program, wherein the load library stores a variety of honeyhole programs;

[0075] Receive and analyze the running information returned by the honeyhole program, and generate the attack path for this threat hunting based on the running information.

[0076] Further, in some optional embodiments, the step of receiving and analyzing the operation information returned by the honeyhole program, and generating the attack path of this threat hunting according to the operation information includes:

[0077] According to the log information, historical operation records, cluster component logs, and gateway history records of the honey node, find out whether the honey node has access behavior from other nodes;

[0078] If the honey-stepping node has access behaviors from other nodes, then the other node is also marked as a honey-stepping node, and the honeyhole program delivery and association analysis process is repeated for the newly marked honey-stepping node to determine whether the newly marked honey-stepping node has access behaviors from other nodes. This process is repeated until the newly marked honey-stepping node has no access behaviors from other nodes. At this time, the other node is defined as the initial foothold;

[0079] If the first node that delivers the honeyhole program has no access from other nodes, the node that delivers the honeyhole program is marked as the initial foothold;

[0080] The link consisting of all honey-stepping nodes from the first honey-stepping node to which the honeyhole program is delivered to the initial foothold serves as the attack path for this threat hunting.

[0081] On the other hand, the present invention further provides a storage medium on which one or more programs are stored, and when the program is executed by a processor, the above-mentioned internal network threat hunting method is implemented.

[0082] On the other hand, the present invention further proposes an electronic device, including a memory and a processor, wherein the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory to implement the above-mentioned internal network threat hunting method.

[0083] Those skilled in the art will appreciate that the logic and / or steps represented in the flowchart or otherwise described herein, for example, may be considered as an ordered list of executable instructions for implementing logical functions, and may be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For purposes of this specification, "computer-readable medium" may be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0084] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0085] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or a combination thereof: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0086] Although the embodiments of the present invention are described in detail above, it is obvious to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as described in the claims. Moreover, the present invention described herein may have other embodiments and may be implemented or realized in a variety of ways.

Claims

1. An internal network threat hunting system, applied to a cloud native cluster, characterized in that: The system comprises: Honeytags are deployed on independent nodes or business nodes of the cloud native cluster. When an attacker triggers a honeytag on a node, the attacker records the node information of the honeytag node and sends an early warning message to the early warning module based on the node information. The early warning module is used to forward the early warning information to the delivery module; The delivery module is used to retrieve the honeyhole program corresponding to the warning information from the load library, and send the location information of the honeyhole program and the honey-stepping node to the management component in the cloud native cluster, so that the management component sends the honeyhole program to the honey-stepping node according to the location information, and the honey-stepping node receives and runs the honeyhole program; The correlation analysis module is used to receive and analyze the operation information returned by the honeyhole program, and generate the attack path of this threat hunting based on the operation information; The payload library is used to store various honeyhole programs.

2. The internal network threat hunting system according to claim 1, characterized in that: The warning information includes system type, version, architecture, location of the honey node, network location of the triggered honey, and attacker network information.

3. The internal network threat hunting system according to claim 2, characterized in that: The honeymark is a simulated Web server, database server, file server, or a simulated service and port, or a file, database entry, key, password deployed on a normal business node, or a forged VPN configuration file; When the honeybean simulates multiple services or opens multiple ports, the warning information also includes the services or ports accessed by the attacker; When the honeytoken is a file-type honeytoken, the warning information also includes the path of the specific file or resource accessed by the attacker.

4. The internal network threat hunting system according to claim 2, characterized in that: The delivery module is used to retrieve a matching honeyhole program from a load library according to the system type, version and architecture.

5. The internal network threat hunting system according to claim 3, characterized in that: The operation information includes the log information of the honey node, historical operation records, cluster component logs, and gateway historical records.

6. The internal network threat hunting system according to claim 5, characterized in that: The association analysis module is also used for: According to the log information, historical operation records, cluster component logs, and gateway history records of the honey node, find out whether the honey node has access behavior from other nodes; If the honey-stepping node has access behaviors from other nodes, then the other node is also marked as a honey-stepping node, and the honeyhole program delivery and association analysis process is repeated for the newly marked honey-stepping node to determine whether the newly marked honey-stepping node has access behaviors from other nodes. This process is repeated until the newly marked honey-stepping node has no access behaviors from other nodes. At this time, the other node is defined as the initial foothold; If the first node that delivers the honeyhole program has no access from other nodes, the node that delivers the honeyhole program is marked as the initial foothold; The link consisting of all honey-stepping nodes from the first honey-stepping node to which the honeyhole program is delivered to the initial foothold serves as the attack path for this threat hunting.

7. An internal network threat hunting method, applied to a cloud native cluster, characterized in that: The method comprises: When an attacker triggers a honeytag on a node, the node information of the honeytag node is recorded, and an early warning message is sent based on the node information; Forward the warning information; Retrieving the honeyhole program corresponding to the warning information from the load library, and sending the honeyhole program and the location information of the honeyhole node to the management component in the cloud native cluster, so that the management component sends the honeyhole program to the honeyhole node according to the location information, and the honeyhole node receives and runs the honeyhole program, wherein the load library stores a variety of honeyhole programs; Receive and analyze the running information returned by the honeyhole program, and generate the attack path for this threat hunting based on the running information.

8. The internal network threat hunting method according to claim 7, characterized in that: The step of receiving and analyzing the operation information returned by the honeyhole program, and generating the attack path of this threat hunting according to the operation information includes: According to the log information, historical operation records, cluster component logs, and gateway history records of the honey node, find out whether the honey node has access behavior from other nodes; If the honey-stepping node has access behaviors from other nodes, then the other node is also marked as a honey-stepping node, and the honeyhole program delivery and association analysis process is repeated for the newly marked honey-stepping node to determine whether the newly marked honey-stepping node has access behaviors from other nodes. This process is repeated until the newly marked honey-stepping node has no access behaviors from other nodes. At this time, the other node is defined as the initial foothold; If the first node that delivers the honeyhole program has no access from other nodes, the node that delivers the honeyhole program is marked as the initial foothold; The link consisting of all honey-stepping nodes from the first honey-stepping node to which the honeyhole program is delivered to the initial foothold serves as the attack path for this threat hunting.

9. A storage medium, characterized in that: The storage medium stores one or more programs, which, when executed by the processor, implement the internal network threat hunting method as described in any one of claims 7-8.

10. An electronic device, comprising a memory and a processor, wherein: The memory is used to store computer programs; When the processor is used to execute the computer program stored in the memory, it implements the internal network threat hunting method as described in any one of claims 7-8.

Images