A honeypot IP dynamic configuration method based on model predictive control

Abstract

The present invention provides a honeypot IP dynamic configuration method based on model predictive control, which belongs to the field of network security technology. In order to solve the problem of insufficient dynamic responsiveness of traditional honeypot IP configuration methods, the present invention provides a honeypot IP dynamic configuration method based on model predictive control. The method is based on the rolling optimization characteristics of model predictive control, analyzes and predicts attack behaviors in real time, allocates and switches honeypot IPs with the optimal strategy, improves the concealment and attractiveness of honeypots, and increases the defense capability of network security systems.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a honeypot IP dynamic configuration method based on model predictive control. Background Art

[0002] In the process of deep integration of digitalization, intelligence and electrification, modern network systems face multiple network security challenges, including dealing with the extremely rich attack tools and technical means of advanced persistent threat attackers. These tools may include custom malware, zero-day vulnerability exploits, and carefully designed backdoor programs, which directly affect the normal operation of network systems. Traditional passive defense measures such as firewalls and intrusion detection systems are difficult to fully cope with, so honeypot technology has gradually become an important active defense strategy. This technology attracts attackers by disguising the IP address and system environment of the real system, providing valuable data for capturing attack patterns and analyzing attack behaviors.

[0003] Although honeypot technology has achieved remarkable results in improving network protection, the traditional static configuration method of honeypot IP, that is, the honeypot IP remains unchanged or the IP update strategy is easily identified as a simulation system by attackers through long-term scanning and traffic analysis. Dynamic configuration of honeypot IP will make attackers more inclined to further explore and test, and at the same time, it can more effectively protect the real system when facing new attack strategies or attack waves to ensure continuous security protection. Considering that the IPs in different locations in each subnet segment of the network system have different deployment values, a dynamic configuration method of honeypot IP based on model predictive control (Model Predictive Control) is proposed. By analyzing the deployment value of each IP in the high-risk segment list one by one, the IP deployment priority list is calculated, and the honeypot IP configuration plan is obtained. Summary of the invention

[0004] The purpose of the present invention is to provide a honeypot IP dynamic configuration method based on model predictive control, which can solve the problem of insufficient dynamic responsiveness of traditional honeypot IP configuration methods.

[0005] The present invention provides a honeypot IP dynamic configuration method based on model predictive control, comprising the following steps:

[0006] S1, obtain different subnet IP address segments in the network system and deploy honeypots in them;

[0007] S2. Evaluate high-risk address segments in different subnet IP address segments;

[0008] S3. Obtain the remaining available IP addresses in the high-risk address segment;

[0009] S4. Calculate the honeypot deployment value of the remaining available IP addresses;

[0010] S5. Constructing an optimization target of model predictive control according to the deployment value;

[0011] S6, solving the optimization objective of the model predictive control to obtain the optimal solution and deploying the honeypot according to the optimal solution;

[0012] S7. Repeat steps S3 to S6 in each control cycle to achieve dynamic configuration of the honeypot IP.

[0013] The present invention provides a honeypot IP dynamic configuration method based on model predictive control. The method analyzes and predicts attack behaviors in real time based on the rolling optimization characteristics of model predictive control, allocates and switches honeypot IPs with the optimal strategy, improves the concealment and attractiveness of the honeypot, and increases the defense capability of the network security system.

[0014] Optionally, when calculating the honeypot deployment value of the remaining available IP addresses, the honeypot deployment value of this IP is determined by calculating the average Hamming distance and the maximum Hamming distance between a target honeypot IP in the remaining available IP addresses and all real system IPs in the same network segment.

[0015] Optionally, when calculating the honeypot deployment value of the remaining available IP addresses, assume For different subnet IP address segments, express A combined range of addresses suitable for defining the address space of multiple network segments.

[0016] Optionally, when calculating the honeypot deployment value of the remaining available IP addresses, the target honeypot IP address is calculated. and network segment address set All real systems in the same network segment The formula for the average Hamming distance is as follows:

[0017]

[0018] in, is the size of the network segment address set, It is the real system network interface.

[0019] Optionally, when calculating the honeypot deployment value of the remaining available IP addresses, the target honeypot IP address is calculated. and network segment address collection The formula for the maximum Hamming distance of all real system IPs in the same network segment is as follows:

[0020] ;

[0021] in, Indicates that the maximum range of the target network segment is not exceeded.

[0022] Optionally, when constructing the optimization target of the model predictive control according to the deployment value, a threshold is set and , define the error function as:

[0023]

[0024] in ,express is a non-negative number used to ensure that the error between the target Hamming distance and the threshold is not less than zero. and is the weight parameter.

[0025] Optionally, when constructing the optimization target of the model predictive control according to the deployment value, the error function is transformed into a quadratic programming problem, which is defined as follows:

[0026] ;

[0027] in, is the variable that needs to be optimized. is a symmetric positive semidefinite matrix, defining the coefficients of the quadratic terms, is the linear term coefficient vector, is the coefficient matrix of the constraint terms, .

[0028] Optionally, when constructing the optimization target of model predictive control according to the deployment value, the objective function is defined as:

[0029]

[0030] The constraints are and , the Lagrange multipliers are and .

[0031] Optionally, when solving the optimization objective of model predictive control to obtain the optimal solution and deploying honeypots according to the optimal solution, the objective function Seek partial derivatives to satisfy and The solution is the optimal solution.

[0032] Optionally, when steps S3 to S6 are repeated in each control cycle, the model predictive control algorithm solves the iterative steps as follows:

[0033] (1) Initialization: Select initial value and Lagrange multipliers and , initialize the iteration step size and the maximum number of iterations;

[0034] (2) Calculate the gradient of the objective function: According to the current and Lagrange multipliers and Calculate the objective function Gradient ;

[0035] (3) Update decision variables: Use gradient descent or quasi-Newton method to update decision variables , and update the Lagrange multiplier according to the constraints. The specific update rules are:

[0036] ;

[0037] in, is the step length, It is The solution of the iteration;

[0038] (4) Check convergence: If the gradient meets the convergence criterion or reaches the maximum number of iterations, stop the iteration and output the final optimal solution;

[0039] (5) Feedback control and update: Based on the current optimal solution Configure the honeypot. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 It is a flow chart of a honeypot IP dynamic configuration method based on model predictive control. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be understood by people with general skills in the field to which the present invention belongs. "Including" and similar words used in this article mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0042] The present invention provides a honeypot IP dynamic configuration method based on model predictive control, such as Figure 1 As shown, the specific steps include:

[0043] S1, obtain different subnet IP address segments in the network system and deploy honeypots in them;

[0044] S2. Evaluate high-risk address segments in different subnet IP address segments;

[0045] S3. Obtain the remaining available IP addresses in the high-risk address segment;

[0046] S4. Calculate the honeypot deployment value of the remaining available IP addresses;

[0047] S5. Constructing an optimization target of model predictive control according to the deployment value;

[0048] S6, solving the optimization objective of the model predictive control to obtain the optimal solution and deploying the honeypot according to the optimal solution;

[0049] S7. Repeat steps S3 to S6 in each control cycle to achieve dynamic configuration of the honeypot IP.

[0050] In fact, when executing step S1, the network system usually involves multiple types of network devices and is widely distributed, so it contains multiple different subnet IP address segments. The IP address segment contains multiple continuous or discrete IP addresses. Deploying honeypots in multiple different subnet IP address segments can simulate the real environment of different network areas, increase the authenticity and complexity of the simulation environment, and thus better conceal the location and characteristics of the real system.

[0051] In fact, when executing step S2, all subnet IP address segments are manually evaluated, identified and listed as high-risk network IP address segments. High-risk network IP address segments refer to those that are unprotected and have a higher risk of exposure. The evaluation basis includes historical attack data, network traffic, device exposure, etc.

[0052] In fact, when executing step S3, the allocation of each high-risk network IP address segment is obtained, including the deployed honeypot IP and the real system IP, so as to obtain the remaining available IP addresses.

[0053] In fact, when executing step S4, in advanced persistent threat attacks or malicious traffic monitoring, the attacker will perform port and IP scans on the system within the target. The closer the IP is to the real system, the more vulnerable it is to attack. The Hamming distance is a measure of the difference between two strings of equal length, especially in binary strings, which refers to the number of different characters in the same position of the two strings. Assume and The binary representation of and , the formula for calculating the Hamming distance between the two is as follows:

[0054] ;

[0055] in, is the indicator function, usually n is 32, when 1 if the value is 0, otherwise it is 0.

[0056] S41. Determine the deployment value of the IP honeypot by calculating the average Hamming distance between a target honeypot IP and all real system IPs in the same network segment among the remaining available IP addresses in the high-risk network segment. Specifically, when the average Hamming distance between the target honeypot IP and the real system is small, the location of the IP is closer to the service IP of the real system, which makes it easier for attackers to mistake the honeypot for a real system, thereby improving the trapping effect of the honeypot. Therefore, the smaller the average Hamming distance, the greater the deployment value of the honeypot.

[0057] S42, set For different subnet IP address segments, express The union range is suitable for defining the address space of multiple network segments. To calculate the set difference, it can be expressed as a complement set:

[0058] ;

[0059] This combined representation allows set operations on IP segments, such as subnet segmentation, excluding specific subnets, and other operations.

[0060] S43. Calculate the target honeypot IP address and network segment address set All real systems in the same network segment The formula for the average Hamming distance is as follows:

[0061]

[0062] in, is the size of the network segment address set, It is the real system network interface.

[0063] S44. Calculate the target honeypot IP address in order to limit the target honeypot IP to a certain range. and network segment address collection The formula for the maximum Hamming distance of all real system IPs in the same network segment is as follows:

[0064] ;

[0065] in, Indicates that the maximum range of the target network segment is not exceeded.

[0066] In fact, when executing step S5, model predictive control is an optimization control method for dynamic systems. It calculates the control input by solving an optimization problem in each control cycle to predict and control the future behavior of the system. The rolling optimization characteristics of model predictive control are used to allocate IP configuration honeypots with the optimal strategy.

[0067] S51. In order to make the model predictive control give priority to deploying IPs with high deployment value when dynamically configuring honeypots, the minimization of the error value is used as the optimization goal of the control strategy. Set the threshold and , the error function is defined according to the average Hamming distance and the maximum Hamming distance:

[0068]

[0069] in ,express is a non-negative number used to ensure that the error between the target Hamming distance and the threshold is not less than zero. and is the weight parameter.

[0070] S52, converting the error function into a quadratic programming problem, which is defined as follows:

[0071] ;

[0072] in, is the variable that needs to be optimized. is a symmetric positive semidefinite matrix, defining the coefficients of the quadratic terms, is the linear term coefficient vector, is the coefficient matrix of the constraint terms, .

[0073] S53, in order to adjust make Minimize, define the objective function as:

[0074] ;

[0075] in, is a eigenvector, which can be further written as follows:

[0076] ;

[0077] In order to solve the objective function, it is necessary to balance the gradient of the objective function and consider the influence of the constraints. The constraints are and , the Lagrange multipliers are and .

[0078] In fact, when executing step S6, in order to find the optimal solution, the KKT (Karush-Kuhn-Tucker) optimal condition needs to be satisfied. Seek partial derivatives to satisfy and The solution is the optimal solution, where The complementary slackness condition ensures that if an inequality constraint is not "tightly" satisfied, i.e., it is not equal to , then the corresponding Lagrange multiplier must be zero. Mathematically expressed as:

[0079]

[0080] This means that at the optimal point, the "relaxation" of any inequality constraint is equal to its corresponding Lagrange multiplier The product is zero.

[0081] In fact, when executing step S7, since the attacker's behavior changes dynamically, the rolling optimization framework allows the optimization model to be re-solved in each control cycle. In each rolling window, new attack data and system status will be used as input, and the new optimal honeypot configuration IP will be calculated and deployed to the honeypot system. This method can respond to changes in attack patterns in real time, improve the deceptiveness of the honeypot and the security protection capabilities of the system. The iterative steps of the model predictive control algorithm are as follows:

[0082] (1) Initialization: Select initial value and Lagrange multipliers and , initialize the iteration step size and the maximum number of iterations;

[0083] (2) Calculate the gradient of the objective function: According to the current and Lagrange multipliers and Calculate the objective function Gradient ;

[0084] (3) Update decision variables: Use gradient descent or quasi-Newton method to update decision variables , and update the Lagrange multiplier according to the constraints. The specific update rules are:

[0085] ;

[0086] in, is the step length, It is The solution of the iteration;

[0087] (4) Check convergence: If the gradient meets the convergence criterion or reaches the maximum number of iterations, stop the iteration and output the final optimal solution;

[0088] (5) Feedback control and update: Based on the current optimal solution Configure the honeypot.

[0089] Although the embodiments of the present invention are described in detail above, it is obvious to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as described in the claims. Moreover, the present invention described herein may have other embodiments and may be implemented or realized in a variety of ways.

Claims

1. A honeypot IP dynamic configuration method based on model predictive control, characterized in that: The following steps are involved: S1, obtain different subnet IP address segments in the network system and deploy honeypots in them; S2. Evaluate high-risk address segments in different subnet IP address segments; S3. Obtain the remaining available IP addresses in the high-risk address segment; S4. Calculate the honeypot deployment value of the remaining available IP addresses, where the honeypot deployment value is determined by the average Hamming distance and the maximum Hamming distance between the honeypot IP and all real system IPs in the same network segment; S41. The calculation method of the Hamming distance is: and The binary representation of and ,in, is the indicator function, usually n is 32, when 1 when it is, otherwise 0; S42. Calculate the target honeypot IP address and network segment address set All real systems in the same network segment The formula for the average Hamming distance is as follows: ； in, express The combined range of different subnet IP address segments, is the size of the network segment address set, It is the real system network interface; S43. Calculate the target honeypot IP address in order to limit the target honeypot IP to a certain range. and network segment address collection The formula for the maximum Hamming distance of all real system IPs in the same network segment is as follows: ； in, Indicates that the maximum range of the target network segment is not exceeded; S5. Constructing an optimization objective of model predictive control to maximize the deployment value of the target honeypot, wherein the optimization objective is to minimize the objective function value; S51. Setting threshold and , according to the average Hamming distance and the maximum Hamming distance obtained in step S4, the error function is defined as: ； in, ,express is a non-negative number used to ensure that the error between the target Hamming distance and the threshold is not less than zero. and is the weight parameter; S52. Convert the error function into a quadratic programming problem, which is defined as follows: ； in, is the variable that needs to be optimized. is a symmetric positive semidefinite matrix, defining the coefficients of the quadratic terms, is the linear term coefficient vector, is the coefficient matrix of the constraint terms, ; S53. Based on the quadratic programming problem, the objective function is defined as follows: ； The constraints are and , the Lagrange multipliers are and ; S6. Find the partial derivative of the objective function to satisfy and The solution of is the optimal solution of the model predictive control optimization objective, where , deploy honeypots according to the optimal solution; S7. Repeat steps S3 to S6 in each control cycle to achieve dynamic configuration of the honeypot IP.

2. According to a method for dynamic configuration of honeypot IP based on model predictive control according to claim 1, it is characterized in that: When steps S3 to S6 are repeated in each control cycle, the iterative steps of the model predictive control algorithm are as follows: (1) Initialization: Select initial value and Lagrange multipliers and , initialize the iteration step size and the maximum number of iterations; (2) Calculate the gradient of the objective function: According to the current and Lagrange multipliers and Calculate the objective function Gradient ; (3) Update decision variables: Use gradient descent or quasi-Newton method to update decision variables , and update the Lagrange multiplier according to the constraints. The specific update rules are: ； in, is the step length, It is The solution of the iteration; (4) Check convergence: If the gradient meets the convergence criterion or reaches the maximum number of iterations, stop the iteration and output the final optimal solution; (5) Feedback control and update: Based on the current optimal solution Configure the honeypot.

Images