Honeypot protection method and system based on user behaviors

Abstract

The invention discloses a honeypot protection method and system based on user behaviors, and belongs to the technical field of network security, and the method comprises the steps: firstly obtaining operation traces of a user in a system, including application interaction traces, file operation traces, network activity traces and system activity traces; extracting a system trace according to the operation trace, and generating a configuration file according to the system trace; and secondly, generating an executed operation list according to the configuration file, executing operations in the operation list, and simulating to generate corresponding traces in the honeypot system. According to the method, simulation of operation of the real system and generation of the operation trace are guided according to the configuration file, then the system with the operation trace is cloned into the honeypot environment, through the operation, the simulation degree of the honeypot system can be improved, and the difficulty of distinguishing the honeypot from the real system by an attacker is remarkably increased.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a honeypot protection method and system based on user behavior. Background Art

[0002] In recent years, people's dependence on the Internet in work and life has become increasingly strong, making the network environment very complex, and various malicious network attacks are also occurring frequently. As a new security tool, honeypots have superior performance in attack detection, analysis, and research, especially in capturing unknown attacks. However, as attackers' attack methods improve, attackers will analyze the characteristics of the target system to determine whether the target system is a honeypot system, and attack users through the honeypot system. Therefore, improving the high simulation of the honeypot system helps to deceive attackers and provide convenience for protecting sensitive networks or studying attacker behavior.

[0003] The application number is 202211460799.3, a honeypot camouflage simulation method, device and electronic device based on protocol proxy. This patent is mainly committed to disguising manufacturer fingerprint parameters, host fingerprint parameters and application service fingerprint parameters, but ignores the simulation of the honeypot system usage traces. Attackers can judge that the current system is a honeypot system by analyzing the usage traces and do not show maliciousness, resulting in the attack behavior cannot be discovered in time. Summary of the invention

[0004] In view of the problems existing in the prior art, the present invention provides a honeypot protection method and system based on user behavior, which can improve the simulation degree of the honeypot system and significantly increase the difficulty for attackers to distinguish between the honeypot and the real system.

[0005] The present invention is achieved through the following technical solutions: A honeypot protection method based on user behavior includes the following steps: Step 1: Obtain the user's operation traces in the system, including application interaction traces, file operation traces, network activity traces, and system activity traces.

[0006] Step 2: Extract system traces based on operation traces, and generate configuration files based on the system traces; Step 3: Generate an operation list according to the configuration file, execute the operations in the operation list, and generate corresponding traces in the honeypot system.

[0007] Preferably, the operation traces described in step 1 include application interaction traces, file operation traces, network activity traces and system activity traces, and statistics are performed on each trace respectively to obtain statistical data of each trace, and the statistical data are used as operation traces.

[0008] Preferably, in step 2, extracting system traces according to the operation traces and generating a configuration file according to the system traces include: Perform statistical analysis on operation traces, obtain system traces and their execution probabilities, and generate configuration files based on the execution probabilities of system traces.

[0009] Preferably, an algorithm of probabilistic and randomized functions is used to determine the event that needs to be executed in the configuration file, the event is executed, a decision is made on the execution result, and the next execution operation is determined based on the decision. After the event is executed, the next event in the execution list is executed.

[0010] Preferably, the execution data of the event is constrained by corresponding statistical data.

[0011] Preferably, in step 3, the event is executed in a transparent control manner to simulate and generate corresponding traces.

[0012] Preferably, traces are generated in the honeypot system by remote control. Preferably, the method further includes deploying a honeypot system on a target system to implement network protection and intrusion detection operations on the target system.

[0013] A honeypot protection system based on user behavior, comprising: The data collector is used to obtain user operation traces in the system, including application interaction traces, file operation traces, network activity traces and system activity traces.

[0014] A user configuration file generator is used to extract system traces based on operation traces and simulate and generate configuration files based on system traces; The event generation module is used to generate an operation list to be executed according to the configuration file, execute the operations in the operation list, and generate corresponding traces in the honeypot system.

[0015] An electronic device, comprising: Memory for storing computer programs; A processor is used to implement the steps of the honeypot protection method based on user behavior when executing the computer program.

[0016] Compared with the prior art, the present invention has the following beneficial technical effects: The present application provides a honeypot protection method based on user behavior. By collecting and simulating the behavioral traces of real users, the method can make the honeypot system closer to the operating state of the real system. This includes application interaction, file operation, network activity, and system activity, which greatly enhances the simulation effect of the honeypot, making it more difficult for attackers to distinguish the difference between the honeypot and the real system. Secondly, enhance concealment: Since the honeypot system simulates the behavioral traces of real users, attackers may mistake it for a real system when invading, thereby reducing their vigilance. This concealment helps the honeypot system better capture attack behaviors and provide valuable data for subsequent attack analysis and research. In addition, by simulating real user behavior, the method can more accurately simulate the scenarios that attackers may encounter, thereby improving the honeypot system's ability to capture unknown attacks. At the same time, since it is difficult for attackers to find anomalies in the honeypot system, it is also easier to expose their attack methods and intentions. By simulating real user behavior, the method can reduce false alarms caused by misjudgment. Because what attackers see in the honeypot system are simulated traces of real user behavior, even if they perform some seemingly suspicious operations, they may only be part of the simulated behavior, thus avoiding unnecessary false alarms and interference.

[0017] The present application also proposes a user behavior-based honeypot protection system, an electronic device and a computer storage medium, which have all the advantages of the above-mentioned user behavior-based honeypot protection method. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0019] Figure 1 It is a flow chart of the honeypot protection method based on user behavior of the present invention; Figure 2 This is the workflow of the event selector and event executor of the present invention. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various different configurations.

[0021] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application for which protection is sought, but merely represents selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0022] Honeypot system, or honeypot technology, is a network security technology that attracts and deceives potential attackers by simulating vulnerable systems, services or information. These systems are deliberately designed to be vulnerable or contain vulnerabilities, but do not contain any valuable data or services. When attackers try to invade these simulated systems, the honeypot system can record their attack behaviors, strategies and tools, thereby providing valuable information about the attackers to the network security team.

[0023] The honeypot system can capture and analyze information such as attackers' network traffic, attack codes, and attempts to exploit vulnerabilities, providing the network security team with detailed data on attackers' behaviors and strategies. When attackers are attracted to the honeypot and begin to attempt to invade, the honeypot system can provide early warnings to the network security team, allowing them to respond to real security threats in a timely manner; by observing attackers' attacks on honeypots, organizations can assess the potential risks and vulnerabilities of their own networks, thereby better planning security measures. At the same time, this information can also help develop new defense measures and improve existing security policies; attackers can determine that the current system is a honeypot system through analysis of usage traces, and do not show malicious intent, resulting in the problem that the attack behavior cannot be discovered in a timely manner.

[0024] Attackers will use system traces to determine whether the attacked system is a fake system. On a typical Linux server, there are mainly the following four types of traces.

[0025] System event traces: Usually, the server will remain in operation for a long time after startup, so various traces will be generated during the operation process, mainly including volatile traces and non-volatile traces. Volatile traces require real-time system activities, such as the number of threads or processes. These traces can directly indicate the usage of the system, record these threads, and run in the system to generate the same trace information. Non-volatile traces mainly include system operation logs. The longer the system is used, the more logs that require interaction will be generated. For example, for a web server, users usually perform command line operations on the web server through ssh. You can understand the user's usage habits based on the commands executed by the user through ssh. For example, the aptupdate and dpkg commands record the system upgrade and program installation information, and simulate the operation of similar commands to generate log traces.

[0026] Disk file system traces: User interaction will inevitably lead to changes in the file system, especially for I / O operations. Users usually store some resources on the disk, and some web services also receive files uploaded by visitors, such as pictures or compressed files. By simulating the existence, deletion or modification of these files in a specific directory, attackers can be misled into thinking that this is a real honeypot system.

[0027] Network traces: The traces generated by the network system are very easy to be exploited by attackers. When users use applications or download files, many network traces will be generated. For example, ARP cache entries store the mapping relationship between IP addresses and corresponding MAC addresses in the network. The existence of ARP can be simulated through pre-set methods. Tomcat services will also generate network access traces such as access logs. The logs can be preset by monitoring the access log information in the real web server.

[0028] Web service traces: Web servers usually run some web-related services, such as tomcat or docker. These services usually generate some traces, such as the number of docker running containers and the number of tomcat running services. You can download some open source docker images or war packages of tomcat services from the Internet to perform deployment simulation and generate corresponding traces.

[0029] This application proposes a honeypot protection method based on user behavior, including the following steps: Step 1: Obtain the user's operation traces in the system, including application interaction traces, file operation traces, network activity traces, and system activity traces.

[0030] Step 2: Extract system traces based on operation traces, and generate configuration files based on the system traces; Step 3: Generate an operation list according to the configuration file, execute the operations in the operation list, and generate corresponding traces in the honeypot system.

[0031] The honeypot protection method generates a configuration file that can summarize the operation behavior of the real system by reading the user operations of the protected system, guides the simulation of the real system operation and the generation of operation traces according to the configuration file, and generates usage traces in the honeypot system. The above operations can improve the simulation degree of the honeypot system and significantly increase the difficulty for attackers to distinguish between the honeypot and the real system.

[0032] Example 1 See also Figure 1 and 2 , a honeypot protection method based on user behavior, comprising the following steps: S1. First, the user's operation is monitored through the data collector to collect the user's operation traces for the generation of user configuration files. The operation traces include application interaction traces, file operation traces, network activity traces and system activity traces.

[0033] Regarding the collection of operation traces: file operation traces include file access, creation, deletion and modification events; system activity traces include the number of running threads and system events; network activity traces include ARP cache entries or network access logs; application interaction traces include the usage time of web application service programs and log files. In order to protect the privacy of users, during the collection of operation traces, the main data collected is user statistics, such as usage time, and no more detailed information is collected.

[0034] S2. Use a user profile generator to analyze the collected operation traces, extract system traces based on these operation traces, and generate a profile based on the system traces. The profile is used to comprehensively reflect the user's use of the system within a certain period of time.

[0035] For the profile generation method, the operation trace data collected by the data collector will be transmitted to the user profile generator, which consists of application and web service usage behaviors and corresponding execution probabilities. These execution probabilities are obtained by statistical analysis of the information collected by the data collection module. These probabilities represent the possibility of the system performing specific behaviors (user operations or application running).

[0036] S3. The event generation module generates a list of operations to be performed according to the configuration file, and the event execution module executes the operations in the operation list and generates corresponding traces in the honeypot system.

[0037] The trace generator is used to execute the operation list. The main task of the trace generator is to continuously simulate the user's operations on a system and generate traces of user usage. The trace generator contains two modules, the event selection module and the event execution module. The event executor selects some specific events according to the user profile, and then the event executor executes these specific events, such as Figure 2 As shown, the event selection module is responsible for deciding which events will be executed based on the configuration file. Each event will trigger a series of subsequent events. The probabilistic and randomized functions in the event selection module select the activities to be simulated and the subsequent activities by reading the information in the configuration file.

[0038] The algorithm of the probabilistic and randomized functions takes the configuration file as input and outputs a list of a series of executed activities. First, the configuration file is loaded to observe the daily usage time, the running probability and duration of each activity and sub-activity, and an activity list is initialized. Secondly, the system simulates the user's operations in the morning and afternoon according to the preset schedule, and the duration will be set according to the statistical data of the user's daily usage time. After that, the response traces are generated in the honeypot system through the remote control method. The system continuously selects activity types from the configuration, and further performs specific sub-type operations under each type, recording the results and time of each operation. During the execution of the above behaviors, it is determined whether the activity should be switched based on the recorded execution time of each activity to ensure that the execution time of each activity does not exceed the specified time in the configuration file.

[0039] The event execution module is mainly responsible for executing the events selected by the event selection module. The parameters required to execute the events are provided by the event selector. The results of the event execution will be returned to the event selection module and a new decision will be generated. Once a new decision is made, the event execution module will perform the next step according to the decision.

[0040] The operations in the trace generation system are introduced below. The generation of traces mainly consists of two stages: pre-simulation stage and simulation stage.

[0041] In the pre-simulation phase, the applications or services and operating environment required for the simulation phase are manually installed in the honeypot system to provide the necessary operating environment for human users, event simulation modules, and event execution modules. For the file system, copies of non-sensitive files can be created from public sources as files for decoy users. There are two main reasons for pre-simulation operations. First, these traces remain unchanged after long-term user operations and do not require daily updates. Second, pre-setting these traces in advance can reduce the complexity of the simulation.

[0042] In the simulation phase, for system traces, the event selection module first selects an application from the installed applications according to the user configuration file, and then the event execution module uses the application to perform predefined operations, such as keyboard input, through transparent control (VNC remote control). The event execution module can also execute various background processes to simulate a real running computer, or trigger other applications. Through these operations, a large number of system events can be generated to increase log records. For disk traces, the event executor module selects various types of files according to the file operations defined in the configuration file, and creates, modifies, or deletes them in the system.

[0043] S4. According to the schedule, use remote control to generate corresponding traces in the honeypot system so that the honeypot system has operation traces.

[0044] The schedule is responsible for periodically controlling the use of the trace generator and performing trace generation operations within a fixed period according to demand. Once the trace generation is completed, the honeypot system will contain the latest generated trace. Generating traces through transparent control has certain advantages over running the trace generator directly on the honeypot system, because if the event executor exists in the honeypot system, it may interfere with the normal operation of the honeypot system, and the attacker may also circumvent the honeypot system by identifying the existence of the trace generator. Remote control does not have such defects because no other unnecessary traces are left in the honeypot system.

[0045] S5. Deploy the honeypot system to implement network protection and intrusion detection operations.

[0046] The present invention can collect user usage information, generate a configuration file that can summarize the operation behavior of the real system, guide the simulation of the real system operation and the generation of operation traces according to the configuration file, so that the honeypot system has operation traces. Through the above operations, the simulation degree of the honeypot system can be improved, and the difficulty for attackers to distinguish between the honeypot and the real system can be significantly increased.

[0047] The honeypot protection system can run on a variety of systems, such as Linux, Windows, and even Android. Secondly, the content collected by the data collector can be diverse. Different systems will have different behavioral operations, and these operations can be collected or simulated. For example, there will be registry traces in the Windows system, which can also be collected as a kind of trace. In addition, the execution method of the event executor is diverse, such as simulating mouse or keyboard input, or simulating a client to access the honeypot system to generate traces.

[0048] The technical problem to be solved by the present invention is how to generate traces of real users to enhance the simulation of the honeypot system, so as to solve the defects existing in the prior art, so that the honeypot system has a more complete camouflage mechanism to prevent being identified as a false system by attackers. The honeypot protection method based on user behavior can be adjusted and optimized according to the behavioral habits and system environment of different users to adapt to different application scenarios and needs. This flexibility enables the honeypot system to better adapt to the complex and changeable network environment, and shows significant advantages in improving simulation, enhancing concealment, improving detection capabilities, strong adaptability and reducing false alarm rates, etc., providing new ideas and methods for network security protection.

[0049] Example 2 Correspondingly, the present application also provides a honeypot protection system based on user behavior, including: The data collector is used to obtain user operation traces in the system, including application interaction traces, file operation traces, network activity traces and system activity traces.

[0050] A user configuration file generator is used to extract system traces according to operation traces and generate configuration files according to the system traces; The event generation module is used to generate an operation list to be executed according to the configuration file, execute the operations in the operation list, and generate corresponding traces in the honeypot system.

[0051] It should be noted that in the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of each module is only a logical function division. There may be other division methods in actual implementation. For example, multiple modules can be combined or integrated into another device, or some features can be ignored or not executed. The module described as a separate component may or may not be physically separated. The component displayed as a module may be a physical unit or multiple physical units, that is, it may be located in one place, or it may be distributed in multiple different places. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment.

[0052] In addition, each module in each embodiment of the present invention may be integrated into a processing unit, each module may exist physically separately, or two or more modules may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of a software functional unit.

[0053] An electronic device provided in an embodiment of the present application includes a memory and a processor. A computer program is stored in the memory. When the processor executes the computer program, the steps of the honeypot protection method based on user behavior described in any of the above embodiments are implemented.

[0054] Another electronic device provided in the embodiment of the present application may also include: an input port connected to the processor, used to transmit multimodal data collected by an external acquisition device to the processor; and a display unit connected to the processor, used to display the processing results of the processor to the outside world; a communication module connected to the processor, used to realize the communication between the electronic device and the outside world. The display unit can be a display panel, a laser scanning display, etc.; the communication mode adopted by the communication module includes but is not limited to mobile high-definition link technology (HML), universal serial bus (USB), high-definition multimedia interface (HDMI), wireless connection (including wireless fidelity technology (WiFi), Bluetooth communication technology, low-power Bluetooth communication technology, and communication technology based on IEEE802.11s).

[0055] An embodiment of the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the steps of the honeypot protection method based on user behavior as described in any of the above embodiments are implemented.

[0056] The computer-readable storage medium involved in the present application includes random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, removable disks, CD-ROMs, or any other form of storage medium known in the technical field.

[0057] For the description of the relevant parts of the honeypot protection system based on user behavior, the electronic device and the computer-readable storage medium provided in the embodiments of the present application, please refer to the detailed description of the corresponding parts in the honeypot protection method based on user behavior provided in the embodiments of the present application, which will not be repeated here. In addition, the parts of the above-mentioned technical solutions provided in the embodiments of the present application that are consistent with the implementation principles of the corresponding technical solutions in the prior art are not described in detail to avoid excessive elaboration.

[0058] The above contents are only for explaining the technical idea of ​​the present invention and cannot be used to limit the protection scope of the present invention. Any changes made on the basis of the technical solution in accordance with the technical idea proposed by the present invention shall fall within the protection scope of the claims of the present invention.

Claims

1. A honeypot protection method based on user behavior, characterized in that: The following steps are involved: Step 1: Obtain the user's operation traces in the system, including application interaction traces, file operation traces, network activity traces, and system activity traces; Step 2: Extract system traces based on operation traces, and generate configuration files based on the system traces; Step 3: Generate an operation list according to the configuration file, execute the operations in the operation list, and generate corresponding traces in the honeypot system.

2. According to a user behavior-based honeypot protection method according to claim 1, it is characterized in that: The operation traces described in step 1 include application interaction traces, file operation traces, network activity traces and system activity traces. Statistics are performed on each trace separately to obtain statistical data of each trace, and the statistical data are used as operation traces.

3. According to the user behavior-based honeypot protection method of claim 1, it is characterized in that: In step 2, system traces are extracted based on the operation traces, and a configuration file is generated based on the system traces, including: Perform statistical analysis on operation traces, obtain system traces and their execution probabilities, and generate configuration files based on the execution probabilities of system traces.

4. According to the user behavior-based honeypot protection method of claim 2, it is characterized in that: The algorithm of probabilistic and randomized functions is used to determine the events that need to be executed in the configuration file, execute the event, make a decision on the execution result, and determine the next execution operation based on the decision. After the event is executed, the next event in the execution list is executed.

5. A honeypot protection method based on user behavior according to claim 4, characterized in that: The execution data of the event is subject to the corresponding statistical data.

6. A honeypot protection method based on user behavior according to claim 1, characterized in that: In step 3, the event is executed in a transparent control manner to simulate and generate corresponding traces.

7. The honeypot protection method based on user behavior according to claim 1 is characterized in that: Use remote control to generate traces in the honeypot system.

8. The honeypot protection method based on user behavior according to claim 1 is characterized in that: The method also includes deploying the honeypot system on the target system to implement network protection and intrusion detection operations on the target system.

9. A honeypot protection system based on user behavior, characterized in that: include: Data collector, used to obtain user operation traces in the system, including application interaction traces, file operation traces, network activity traces and system activity traces; A user configuration file generator is used to extract system traces based on operation traces and simulate and generate configuration files based on system traces; The event generation module is used to generate an operation list to be executed according to the configuration file, execute the operations in the operation list, and generate corresponding traces in the honeypot system.

10. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the honeypot protection method based on user behavior as described in any one of claims 1 to 8 when executing the computer program.

Images