Active trapping method, device and equipment based on network feature analysis and medium

Abstract

The invention discloses an active trapping method and device based on network feature analysis, equipment and a medium. The method comprises the following steps: performing traffic mirroring on access traffic data through a traffic arrangement module to obtain traffic mirroring data; performing flow detection on the flow mirror image data through a network feature analysis module according to a malicious IP information library and an attack feature information library; performing flow arrangement on the flow mirror image data through a flow arrangement module according to the flow detection result; the suspected malicious traffic is redirected to the dynamic simulation module through the attack trapping module; the suspected malicious traffic is trapped through a dynamic simulation module; gathering and analyzing trapping results through a honeynet management module to obtain local intelligence data; and the threat intelligence module generates intelligence enabling data according to the cloud intelligence data and the local intelligence data, and updates the malicious IP intelligence library and the attack feature intelligence library according to the intelligence enabling data. The security of the service system is improved, and the method can be widely applied to the technical field of network security.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an active trapping method, device, equipment and medium based on network feature analysis. Background Art

[0002] As an active defense network security technology, honeypot is mainly used to trap and analyze the behavior of network attackers, thereby improving the effectiveness of defense strategies. In the current network security field, honeypot technology has been widely used and developed. The honeypot system simulates the real network environment and system to attract potential attackers and record their activities for security experts to analyze and study. This technology has important application value at multiple levels, including detecting and defending against advanced persistent threats, analyzing malware behavior, obtaining attack patterns and methods, and improving overall network security situation awareness.

[0003] Honeypot technology is particularly prominent in the defense against advanced persistent threats. APT attacks are usually highly concealed and persistent, and traditional security defense measures are difficult to effectively detect and respond to. By deploying advanced honeypots, these advanced attackers can be effectively lured, their intrusion methods and behavior paths can be recorded, and valuable data can be provided for subsequent threat intelligence analysis. This not only helps to detect and block attacks in a timely manner, but also improves the security defense level of the entire organization. Honeypot technology also plays an important role in the field of malware analysis. Security researchers can capture spreading malware samples through honeypots and analyze them in detail in a controlled environment. By observing the behavior of malware in honeypots, researchers can understand its propagation method, infection mechanism, and specific malicious behavior. This information is crucial for developing an effective malware defense strategy and can help security vendors and organizations update and improve their protection measures more quickly.

[0004] Honeypots are also widely used to obtain attack patterns and methods. By analyzing the attacker's behavior in the honeypot system, we can understand the tools, techniques, and tactics used by the attacker. This information can provide direct data support for the collection and analysis of threat intelligence. Especially for new attacks and unknown threats, honeypots can provide first-hand attack intelligence, enabling security experts to quickly understand and respond to emerging security threats. In addition, honeypot technology has significant advantages in improving network security situation awareness capabilities. By deploying multiple honeypot nodes in the network, the security team can monitor and analyze suspicious activities in the network in real time. The attack data captured by the honeypot can be correlated and analyzed with other security events to provide a more comprehensive view of the threat situation. This comprehensive threat perception capability is essential for timely detection and response to network attacks and ensuring network security.

[0005] At the same time, with the development of cloud computing and the Internet of Things, honeypot technology is also expanding into these emerging fields. In a cloud environment, honeypots can be deployed on virtualization platforms to simulate various cloud services and applications and trap attacks against cloud platforms. In an IoT environment, honeypots can simulate various smart devices and capture attack behaviors against IoT devices. These new application scenarios further expand the scope of application of honeypot technology, allowing it to play a role in a wider range of network environments.

[0006] However, the current industry solutions for active trapping still have great limitations, one of which is the passivity of honeypot technology. Specifically, honeypots can only passively wait for attackers to actively launch attacks and fall into the traps they set, but cannot actively guide attackers into the honeypot. This passivity limits the effectiveness and coverage of honeypots to a certain extent. Since honeypots require attackers to actively attack, their effectiveness in capturing attacks depends on the targets chosen by the attackers. If the attacker avoids the honeypot or is aware of the existence of the honeypot, the honeypot will find it difficult to play its due role. Although high-simulation honeypots can attract attackers by disguising themselves as high-value targets, this method still has limitations and cannot ensure that all attackers will be fooled. Summary of the invention

[0007] The purpose of the present invention is to solve one of the technical problems existing in the prior art to at least a certain extent.

[0008] To this end, an object of an embodiment of the present invention is to provide an active trapping method based on network feature analysis, which can more accurately actively trap suspected malicious traffic, thereby timely discovering real attack behaviors and blocking them, thereby improving the security of the business system.

[0009] Another object of an embodiment of the present invention is to provide an active trapping device based on network feature analysis.

[0010] In order to achieve the above technical objectives, the technical solutions adopted by the embodiments of the present invention include:

[0011] On the one hand, an embodiment of the present invention provides an active trapping method based on network feature analysis, comprising the following steps:

[0012] Performing traffic mirroring on the access traffic data through the traffic orchestration module to obtain traffic mirroring data, and sending the traffic mirroring data to the network feature analysis module;

[0013] Performing flow detection on the flow mirror data according to the malicious IP intelligence library and the attack feature intelligence library through the network feature analysis module, and returning the flow detection result to the flow orchestration module;

[0014] The traffic orchestration module performs traffic orchestration on the traffic mirror data according to the traffic detection result, so that suspected malicious traffic is forwarded to the attack trapping module;

[0015] Redirecting the suspected malicious traffic to the dynamic simulation module through the attack trapping module;

[0016] The suspected malicious traffic is trapped by the dynamic simulation module, and the trapping result is output to the honeynet management module;

[0017] The honeynet management module summarizes and analyzes the trapping results to obtain local intelligence data, and sends the local intelligence data to the threat intelligence module;

[0018] The threat intelligence module generates intelligence enabling data based on the cloud intelligence data and the local intelligence data, and updates the malicious IP intelligence library and the attack feature intelligence library based on the intelligence enabling data.

[0019] Further, in one embodiment of the present invention, the flow detection of the flow mirror data according to the malicious IP intelligence library and the attack feature intelligence library specifically includes:

[0020] Determine the source IP of the traffic mirror data, perform a matching search on the source IP according to the malicious IP intelligence library, and determine whether the source IP is a malicious IP;

[0021] When the source IP is a malicious IP, the traffic mirror data is subjected to attack feature detection according to the attack feature intelligence library. If the traffic mirror data has the attack feature, the traffic mirror data is determined to be malicious traffic. If the traffic mirror data does not have the attack feature, the traffic mirror data is determined to be suspected malicious traffic.

[0022] When the source IP is not a malicious IP, attack feature detection is performed on the traffic mirror data according to the attack feature intelligence library. If the traffic mirror data has the attack feature, the traffic mirror data is determined to be suspected malicious traffic. If the traffic mirror data does not have the attack feature, the traffic mirror data is determined to be real access traffic.

[0023] Further, in an embodiment of the present invention, the performing traffic orchestration on the traffic mirroring data according to the traffic detection result specifically includes:

[0024] Forwarding the real access traffic to the real business system;

[0025] Forwarding the suspected malicious traffic to the attack trapping module;

[0026] The malicious traffic is blocked, and the malicious IP corresponding to the malicious traffic is banned.

[0027] Furthermore, in one embodiment of the present invention, the dynamic simulation module includes multiple high-simulation honeypots, which are obtained based on the simulation of a real business system. The high-simulation honeypots have multiple exploitable vulnerabilities built in. The multiple high-simulation honeypots imitate the real business topology to form a honeynet. The attack trapping module is bound to the service port of the high-simulation honeypot to redirect the suspected malicious traffic to the high-simulation honeypot.

[0028] Furthermore, in one embodiment of the present invention, trapping the suspected malicious traffic specifically includes:

[0029] The suspected malicious traffic is trapped by using the built-in exploitable vulnerability of the high-simulation honeypot, and the suspected malicious traffic is monitored for attack behaviors;

[0030] When the suspected malicious traffic contains attack behavior, an alarm log is recorded, and sample analysis and attack traffic source tracing are performed on the suspected malicious traffic to obtain an analysis log and an original traffic log.

[0031] Further, in one embodiment of the present invention, the local intelligence data is obtained by summarizing and analyzing the trapping results, which specifically includes:

[0032] Merge the alarm logs output by the multiple high-simulation honeypots to obtain the attack start time, attack end time, attack target IP and attack type;

[0033] Perform correlation analysis on the analysis logs output by the multiple high-simulation honeypots to obtain the attack source IP and the attack tool used by the attacker;

[0034] Tracing the original traffic logs output by the multiple high-simulation honeypots to obtain the attacker's personal ID, device fingerprint, and device MAC;

[0035] An attacker portrait is generated according to the personal ID, the device fingerprint, the device MAC, the attack source IP, the attack tool, the attack start time, the attack end time, the attack target IP and the attack type, and the attacker portrait is used as the local intelligence data.

[0036] Further, in one embodiment of the present invention, intelligence enabling data is generated according to the cloud intelligence data and the local intelligence data, and the malicious IP intelligence library and the attack feature intelligence library are updated according to the intelligence enabling data, which specifically includes:

[0037] Get cloud intelligence data in real time;

[0038] Determine the attacker's source IP and attack feature data based on the cloud intelligence data and the local intelligence data;

[0039] The attacker source IP and the attack feature data are sent as the intelligence enabling data to the network feature analysis module, so that the network feature analysis module updates the malicious IP intelligence library according to the attacker source IP, and updates the attack feature intelligence library according to the attack feature data.

[0040] On the other hand, an embodiment of the present invention provides an active trapping device based on network feature analysis, including a traffic orchestration module, a network feature analysis module, an attack trapping module, a dynamic simulation module, a honeynet management module and a threat intelligence module, wherein:

[0041] The traffic orchestration module is used to perform traffic mirroring on the access traffic data to obtain traffic mirroring data, and send the traffic mirroring data to the network feature analysis module, and is also used to perform traffic orchestration on the traffic mirroring data according to the traffic detection result returned by the network feature analysis module, so that suspected malicious traffic is forwarded to the attack trapping module;

[0042] The network feature analysis module is used to perform flow detection on the flow mirror data according to the malicious IP intelligence library and the attack feature intelligence library, and return the flow detection result to the flow orchestration module;

[0043] The attack trapping module is used to redirect the suspected malicious traffic to the dynamic simulation module;

[0044] The dynamic simulation module is used to trap the suspected malicious traffic and output the trapping result to the honeynet management module;

[0045] The honeynet management module is used to summarize and analyze the trapping results to obtain local intelligence data, and send the local intelligence data to the threat intelligence module;

[0046] The threat intelligence module is used to generate intelligence enabling data based on the cloud intelligence data and the local intelligence data, and to update the malicious IP intelligence library and the attack feature intelligence library based on the intelligence enabling data.

[0047] On the other hand, an embodiment of the present invention provides an electronic device, comprising a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory, wherein the program, when executed by the processor, realizes the active trapping method based on network feature analysis as described above.

[0048] On the other hand, an embodiment of the present invention further provides a storage medium, which is a computer-readable storage medium used for computer-readable storage, and the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the active trapping method based on network feature analysis as described above.

[0049] The advantages and beneficial effects of the present invention will be partly given in the following description, partly become apparent from the following description, or be understood through the practice of the present invention:

[0050] The embodiment of the present invention performs traffic mirroring on access traffic data through a traffic orchestration module to obtain traffic mirroring data, and sends the traffic mirroring data to a network feature analysis module; performs traffic detection on the traffic mirroring data according to a malicious IP intelligence library and an attack feature intelligence library through the network feature analysis module, and returns the traffic detection result to the traffic orchestration module; performs traffic orchestration on the traffic mirroring data according to the traffic detection result, so that suspected malicious traffic is forwarded to an attack trapping module; redirects the suspected malicious traffic to a dynamic simulation module through the attack trapping module; traps the suspected malicious traffic through the dynamic simulation module, and outputs the trapping result to a honeynet management module; summarizes and analyzes the trapping result through the honeynet management module to obtain local intelligence data, and sends the local intelligence data to a threat intelligence module; generates intelligence enabling data according to cloud intelligence data and local intelligence data through the threat intelligence module, and updates the malicious IP intelligence library and the attack feature intelligence library according to the intelligence enabling data. The embodiment of the present invention performs active trapping based on the network feature analysis module, and cooperates with traffic orchestration to guide suspected malicious traffic to a dynamic simulation honeypot for attack trapping, thereby realizing attack evidence collection and portrait restoration of the attacker, and obtains threat intelligence data by summarizing and analyzing the trapping results, empowering the network feature analysis module with threat intelligence, forming an automated traffic orchestration disposal script, and improving the threat disposal efficiency; utilizing the nested design of traffic orchestration module, network feature analysis module, attack trapping module, dynamic simulation module, honeynet management module and threat intelligence module to form a closed-loop, sustainable, high-accuracy active trapping defense system, which improves the situation where the defender can only passively wait for the attacker to fall into the trap, and can more accurately actively trap suspected malicious traffic, thereby timely discovering and blocking real attack behaviors, protecting real business systems from infringement, and improving the security of business systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the technical solution in the embodiments of the present invention, the following introduction is made to the drawings required for use in the embodiments of the present invention. It should be understood that the drawings introduced below are only for the convenience of clearly describing some embodiments of the technical solution of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0052] Figure 1 A flowchart of a method for active trapping based on network feature analysis provided by an embodiment of the present invention;

[0053] Figure 2 A schematic diagram of data interaction of an active trapping method based on network feature analysis provided by an embodiment of the present invention;

[0054] Figure 3 A step flow chart of step S102 provided in an embodiment of the present invention;

[0055] Figure 4 A step flow chart of step S103 provided in an embodiment of the present invention;

[0056] Figure 5 A step flow chart of step S105 provided in an embodiment of the present invention;

[0057] Figure 6 A step flow chart of step S106 provided in an embodiment of the present invention;

[0058] Figure 7 A step flow chart of step S107 provided in an embodiment of the present invention;

[0059] Figure 8 A schematic diagram of the structure of an active trapping device based on network feature analysis provided by an embodiment of the present invention;

[0060] Fig. 9 A schematic diagram of the hardware structure of an electronic device provided by an embodiment of the present invention;

[0061] Fig.10 A schematic diagram of the structure of a storage medium provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0062] Embodiments of the present invention are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be understood as limitations on the present application. It should be noted that, although the functional module division is performed in the system schematic diagram and the logical order is shown in the flow chart, in some cases, the steps shown or described may be performed in a different order from the module division in the system schematic diagram or the flow chart. For the step numbers in the following embodiments, they are only set for the convenience of explanation, and the order between the steps is not limited in any way. The execution order of each step in the embodiment can be adaptively adjusted according to the understanding of those skilled in the art.

[0063] In the description of the present invention, the meaning of "a plurality" is two or more. If there is a description of the first or the second, it is only for the purpose of distinguishing the technical features, and it cannot be understood as indicating or implying the relative importance or implicitly indicating the number of the indicated technical features or implicitly indicating the order of the indicated technical features. In addition, unless otherwise defined, all technical and scientific terms used in this document have the same meaning as those commonly understood by technicians in the technical field of this application. The terms used in this document are only for the purpose of describing the embodiments of the present application and are not intended to limit the present application.

[0064] The active trapping method based on network feature analysis provided in the embodiments of the present application can be applied to the terminal, can also be applied to the server side, and can also be software running in the terminal or the server side. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, a set-top box, etc.; the server side can be configured as an independent physical server, or a server cluster or a distributed system composed of multiple physical servers, and can also be configured as a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application that implements the active trapping method based on network feature analysis, etc., but is not limited to the above forms.

[0065] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronic devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0066] It should be noted that in each specific implementation of the present application, when it comes to the need to perform relevant processing based on data related to user identity or characteristics such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first, and the collection, use, and processing of these data will comply with the relevant laws, regulations, and standards of the relevant countries and regions. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or consent will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the user's separate permission or consent, the necessary user-related data for the normal operation of the embodiment of the present application will be obtained.

[0067] like Figure 1 FIG. 1 is a flowchart of a method for active trapping based on network feature analysis provided by an embodiment of the present invention, referring to FIG. Figure 1 The embodiment of the present invention provides an active trapping method based on network feature analysis, which specifically includes the following steps:

[0068] S101, performing traffic mirroring on access traffic data through a traffic orchestration module to obtain traffic mirror data, and sending the traffic mirror data to a network feature analysis module;

[0069] S102, using the network feature analysis module to perform traffic detection on the traffic mirror data according to the malicious IP intelligence library and the attack feature intelligence library, and returning the traffic detection result to the traffic orchestration module;

[0070] S103, performing traffic orchestration on the traffic mirroring data according to the traffic detection result through the traffic orchestration module, so that the suspected malicious traffic is forwarded to the attack trapping module;

[0071] S104, redirecting suspected malicious traffic to the dynamic simulation module through the attack trapping module;

[0072] S105, trapping suspected malicious traffic through a dynamic simulation module, and outputting the trapping results to a honeynet management module;

[0073] S106, summarizing and analyzing the trapping results through the honeynet management module to obtain local intelligence data, and sending the local intelligence data to the threat intelligence module;

[0074] S107. Generate intelligence enabling data based on cloud intelligence data and local intelligence data through the threat intelligence module, and update the malicious IP intelligence library and attack feature intelligence library based on the intelligence enabling data.

[0075] like Figure 2 FIG. 1 is a schematic diagram of data interaction of an active trapping method based on network feature analysis provided by an embodiment of the present invention. Figure 2 The description of the relevant modules is as follows:

[0076] The traffic orchestration module is responsible for completing traffic mirroring, traffic orchestration, and blocking. It mirrors the access traffic to the network feature analysis module, and then makes judgments based on the results of the network feature analysis module. It proactively forwards suspected malicious traffic to the attack trapping module or blocks malicious IP addresses, thereby achieving proactive threat trapping and disposal.

[0077] The network feature analysis module performs network feature analysis on access traffic based on threat intelligence and attack feature library to achieve active threat feature analysis;

[0078] The attack trap module is the entrance to the honeynet, which is mapped and bound to the dynamic simulation module to redirect suspected malicious traffic to the dynamic simulation module, thus realizing active threat trapping and diversion;

[0079] The dynamic simulation module is a honeynet composed of multiple high-simulation honeypots, which collects attack evidence and portraits of attackers entering the honeynet area to achieve active tracing and evidence collection;

[0080] The honeynet management module summarizes and analyzes the trapping results of the dynamic simulation module, generates threat intelligence data and sends it to the threat intelligence module to realize active threat intelligence data production;

[0081] The threat intelligence module produces intelligence and provides intelligence empowerment for the network feature analysis module, thereby realizing proactive threat intelligence empowerment.

[0082] The embodiment of the present invention performs active trapping based on the network feature analysis module, and cooperates with traffic orchestration to guide suspected malicious traffic to a dynamic simulation honeypot for attack trapping, thereby realizing attack evidence collection and portrait restoration of the attacker, and obtains threat intelligence data by summarizing and analyzing the trapping results, empowering the network feature analysis module with threat intelligence, forming an automated traffic orchestration disposal script, and improving the threat disposal efficiency; utilizing the nested design of traffic orchestration module, network feature analysis module, attack trapping module, dynamic simulation module, honeynet management module and threat intelligence module to form a closed-loop, sustainable, high-accuracy active trapping defense system, which improves the situation where the defender can only passively wait for the attacker to fall into the trap, and can more accurately actively trap suspected malicious traffic, thereby timely discovering and blocking real attack behaviors, protecting real business systems from infringement, and improving the security of business systems.

[0083] like Figure 3 FIG. 1 is a flow chart of step S102 provided in an embodiment of the present invention, referring to FIG. Figure 3 As an optional implementation method, traffic detection is performed on the traffic mirror data according to the malicious IP intelligence library and the attack feature intelligence library, which specifically includes:

[0084] S1021, determine the source IP of the traffic mirror data, perform a match search on the source IP according to the malicious IP intelligence database, and determine whether the source IP is a malicious IP;

[0085] S1022, when the source IP is a malicious IP, the traffic mirror data is subjected to attack feature detection according to the attack feature intelligence library. If the traffic mirror data has the attack feature, the traffic mirror data is determined to be malicious traffic. If the traffic mirror data does not have the attack feature, the traffic mirror data is determined to be suspected malicious traffic.

[0086] S1023. When the source IP is not a malicious IP, attack feature detection is performed on the traffic mirror data according to the attack feature intelligence library. If the traffic mirror data has the attack feature, the traffic mirror data is determined to be suspected malicious traffic. If the traffic mirror data does not have the attack feature, the traffic mirror data is determined to be real access traffic.

[0087] Specifically, the network feature analysis module performs the following tasks:

[0088] Threat intelligence update: Update the IP intelligence library of the network feature analysis module based on malicious IP enabled by the threat intelligence module;

[0089] Attack signature library update: Update the attack signature library of the network signature analysis module based on the attack signatures enabled by the threat intelligence module;

[0090] Threat intelligence matching: Compare the source IP of the access traffic sent by the traffic orchestration module. If the malicious IP in the IP intelligence library is hit, the access traffic will be marked as suspected malicious traffic, and then the attack characteristics will be analyzed and detected. If the detection rules are hit, the access traffic will be marked as malicious traffic, otherwise it will be marked as suspected malicious traffic; if the malicious IP in the IP intelligence library is not hit, the attack characteristics will be analyzed and detected. If the detection rules are hit, the access traffic will be marked as suspected malicious traffic, otherwise it will be marked as real access traffic.

[0091] Attack signature library matching: Analyze the access traffic sent by the traffic orchestration module, and mark the access traffic (real access traffic, suspected malicious traffic, malicious traffic) by comparing the attack payload with the attack signature library.

[0092] like Figure 4 FIG. 1 is a flow chart of step S103 provided in an embodiment of the present invention, referring to FIG. Figure 4 As an optional implementation, traffic orchestration is performed on the traffic mirroring data according to the traffic detection result, which specifically includes:

[0093] S1031, forwarding the real access traffic to the real business system;

[0094] S1032, forwarding suspected malicious traffic to the attack trapping module;

[0095] S1033. Block malicious traffic and ban the malicious IP address corresponding to the malicious traffic.

[0096] Specifically, the traffic orchestration module has the following capabilities:

[0097] Traffic mirroring: A copy of the access traffic is configured to the mirroring service and sent to the network feature analysis module for analysis;

[0098] Traffic forwarding: forward access traffic to a specific destination through configuration, such as a real business system or an attack trap module;

[0099] One-click blocking: Block high-confidence malicious IP addresses by setting ACL access control lists;

[0100] Orchestration script generation: Based on SOAR technology, an automated processing script is generated for traffic marking and sent to the traffic orchestration module. The real access traffic is forwarded to the real business system, the suspected malicious traffic is forwarded to the attack trapping module, and the malicious traffic is blocked.

[0101] Script execution: SOAR script execution based on the analysis results of the network feature analysis module, choose to forward real access traffic to the real business system, or attack the malicious traffic trap module, or block high-confidence malicious IP with one click.

[0102] Further as an optional implementation method, the dynamic simulation module includes multiple high-simulation honeypots, which are obtained based on the simulation of a real business system. The high-simulation honeypots have multiple exploitable vulnerabilities built in. The multiple high-simulation honeypots imitate the real business topology to form a honeynet. The attack trapping module is bound to the service port of the high-simulation honeypot to redirect suspected malicious traffic to the high-simulation honeypot.

[0103] Specifically, the attack trapping module implements the following capabilities:

[0104] Port mapping: As the port mapping node of the high-simulation honeypot in the dynamic simulation module, it is bound to the service port of the high-simulation honeypot;

[0105] Traffic redirection: redirects suspected malicious traffic forwarded by the traffic orchestration module to the high-simulation honeypot in the dynamic simulation module;

[0106] Micro-isolation: As the entrance to active trapping, the attack trapping module should be subject to strict access control, and fine-grained micro-isolation should be performed on the traffic flow, allowing only access to the high-simulation honeypot in the dynamic simulation module.

[0107] like Figure 5 FIG. 1 is a flow chart of step S105 provided in an embodiment of the present invention, referring to FIG. Figure 5 As an optional implementation, the suspected malicious traffic is trapped, which specifically includes:

[0108] S1051, trap suspected malicious traffic through the built-in exploitable vulnerabilities of the high-simulation honeypot, and monitor whether the suspected malicious traffic has attack behavior;

[0109] S1052. When suspected malicious traffic contains attack behavior, an alarm log is recorded, and sample analysis and attack traffic source tracing of the suspected malicious traffic are performed to obtain analysis logs and original traffic logs.

[0110] Specifically, the dynamic simulation module has the following features:

[0111] High simulation: The honeypot in the dynamic simulation module is highly simulated 1:1 based on the real business system, and multiple high-simulation honeypots imitate the real business topology to form a honeynet;

[0112] High sweetness: The honeypot in the dynamic simulation module has built-in high-sweetness bait to induce attackers to reveal their true attack intentions;

[0113] Attack feature extraction: The honeypot in the dynamic simulation module has multiple built-in exploitable vulnerabilities to induce attackers to exploit the vulnerabilities and record the attacker's exploitation process.

[0114] Attack behavior collection: For attackers who enter the honeypot in the dynamic simulation module, the system supports reproducing the attacker's attack behavior through command line playback or screen recording.

[0115] like Figure 6 FIG. 1 is a flow chart of step S106 provided in an embodiment of the present invention, referring to FIG. Figure 6 As an optional implementation, the trapping results are summarized and analyzed to obtain local intelligence data, which specifically includes:

[0116] S1061, merging the alarm logs output by multiple high-simulation honeypots to obtain the attack start time, attack end time, attack target IP, and attack type;

[0117] S1062, performing correlation analysis on the analysis logs output by multiple high-simulation honeypots to obtain the attack source IP and the attack tools used by the attacker;

[0118] S1063, tracing the original traffic logs output by multiple high-simulation honeypots to obtain the attacker's personal ID, device fingerprint, and device MAC;

[0119] S1064. Generate an attacker portrait based on personal ID, device fingerprint, device MAC, attack source IP, attack tool, attack start time, attack end time, attack target IP, and attack type, and use the attacker portrait as local intelligence data.

[0120] Specifically, the honeynet management module can uniformly manage multiple high-simulation honeypots in the dynamic simulation module, including:

[0121] Honeypot deployment: manage the generation, deployment, editing, deletion, and honeynet orchestration of honeypots;

[0122] Bait deployment: manage the generation, format, type, content, deletion, and placement path of bait files in the honeypot;

[0123] Countermeasure monitoring: For countermeasure baits, such as remote control Trojan-installing baits, the attacker's terminal can be remotely controlled or monitored to conduct active tracing and countermeasures.

[0124] Information tracing: For tracing baits, the attacker’s social account ID is obtained through the jsonp interface of the social website for active tracing.

[0125] Attacker portrait: Combine the entrapment information of multiple honeypots to summarize a high-precision attacker portrait. The attacker's information includes social account ID, device fingerprint, device MAC, attack start time, attack end time, attack target IP, attack source IP, attack tools used, attack type, attack characteristics, etc.

[0126] like Figure 7 FIG. 1 is a flow chart of step S107 provided in an embodiment of the present invention, referring to FIG. Figure 7 As an optional implementation method, intelligence enabling data is generated based on the cloud intelligence data and the local intelligence data, and the malicious IP intelligence library and the attack feature intelligence library are updated based on the intelligence enabling data, which specifically includes:

[0127] S1071, real-time acquisition of cloud intelligence data;

[0128] S1072. Determine the attacker's source IP and attack feature data based on the cloud intelligence data and the local intelligence data;

[0129] S1073. Send the attacker's source IP and attack feature data as intelligence empowerment data to the network feature analysis module, so that the network feature analysis module updates the malicious IP intelligence library according to the attacker's source IP, and updates the attack feature intelligence library according to the attack feature data.

[0130] Specifically, the threat intelligence module generates threat intelligence based on the intelligence data of the honeynet management module, including:

[0131] Attack characteristics: The attack methods and vulnerability exploits used by attackers in the honeypot are formed into attack characteristics;

[0132] Malicious sample MD5: summarizes the MD5 of samples that are judged to be malicious after execution in the honeypot sandbox;

[0133] Malicious IP: Merge the source IP of the attacker’s profile and include it in the IP intelligence database.

[0134] The method steps of the embodiments of the present invention are described above.

[0135] A specific process of an embodiment of the present invention is as follows.

[0136] Step 1: The traffic orchestration module mirrors the access traffic to the network feature analysis module, which analyzes and detects the traffic through attack feature detection, semantic analysis, rule matching, intelligence matching, and other methods, and marks the analysis results;

[0137] Step 2: The network feature analysis module detects access traffic based on the intelligence empowerment of the threat intelligence module and the attack feature library, and returns the detection results to the traffic orchestration module. The analysis results are divided into real access traffic, suspected malicious traffic, and malicious traffic;

[0138] Step 3: The traffic orchestration module makes an execution judgment based on the detection results returned by the network feature analysis module. If it is marked as real access traffic, the traffic is forwarded to the real business system; if it is marked as suspected malicious traffic, the traffic is forwarded to the attack trapping module; if it is marked as malicious traffic, the traffic is directly blocked;

[0139] Step 4: The attack trapping module redirects the suspected malicious traffic to the dynamic simulation module, which monitors the traffic, performs sample analysis, and stores the attack traffic source.

[0140] Step 5: The dynamic simulation module outputs the trapping results to the honeynet management module, including alarm logs, analysis logs, original traffic logs and other information;

[0141] Step 6: The honeynet management module summarizes and analyzes the trapping results output by multiple honeypots in the dynamic simulation module, merges alarms, and performs correlation analysis on multiple honeypots, generates attack portraits to form local intelligence data, and sends them to the threat intelligence module;

[0142] Step 7: The threat intelligence module combines the cloud intelligence and the local intelligence produced by the honeynet management module, and regularly sends the source IP, MD5, attack characteristics and other information of the suspected malicious traffic as intelligence data to the network feature analysis module to complete the intelligence empowerment of the network feature analysis module.

[0143] It can be recognized that the embodiment of the present invention performs active trapping based on the network feature analysis module, and cooperates with traffic orchestration to guide suspected malicious traffic to the dynamic simulation honeypot for attack trapping, thereby realizing attack evidence collection and portrait restoration of the attacker, and obtains threat intelligence data by summarizing and analyzing the trapping results, empowering the network feature analysis module with threat intelligence, forming an automated traffic orchestration disposal script, and improving the threat disposal efficiency; utilizing the nested design of traffic orchestration module, network feature analysis module, attack trapping module, dynamic simulation module, honeynet management module and threat intelligence module to form a closed-loop, sustainable, high-accuracy active trapping defense system, which improves the situation where the defender can only passively wait for the attacker to fall into the trap, and can more accurately actively trap suspected malicious traffic, thereby timely discovering and blocking real attack behaviors, protecting real business systems from infringement, and improving the security of business systems.

[0144] Compared with the prior art, the embodiments of the present invention also have the following advantages:

[0145] 1) Form a multi-module collaborative active trapping system. The system discovers malicious traffic based on network feature analysis, actively traps malicious traffic with a highly simulated honeynet, and uses traffic orchestration technology to handle malicious traffic.

[0146] 2) Enable network feature analysis with high-confidence threat intelligence. Empower the network feature analysis module with high-confidence threat intelligence, drive the network feature analysis module to continuously improve the malicious traffic recognition rate, and achieve efficient and proactive threat detection.

[0147] 3) Realize active trapping in high-sweetness honeynets, use traffic orchestration and redirection technology to divert suspected malicious traffic identified by the network feature analysis module to a honeynet composed of multiple highly simulated honeypot nodes, and record the attacker's attack behavior, methods, tools, etc. in detail to form a multi-dimensional and three-dimensional attacker portrait, realize active trapping and attack behavior tracing and evidence collection.

[0148] 4) By integrating multiple functional modules such as network feature analysis, traffic orchestration, attack trapping, dynamic simulation, honeynet management and threat intelligence, it is not only more advanced in technology, but also demonstrates significant effects in many aspects in practical applications.

[0149] 5) Identify abnormal behaviors and potential threats by monitoring network traffic in real time. Unlike the passive waiting of traditional honeypots, network feature analysis uses attack feature libraries and threat intelligence to dynamically analyze traffic features in the network and proactively discover potential attackers. This method can identify the intentions of attackers and take trapping measures before they approach the real target. By guiding and redirecting suspicious traffic, attackers are directed to the honeypot system. Traditional honeypots require attackers to actively contact them, but traffic orchestration can proactively intervene and divert attack traffic to the honeypot.

[0150] 6) Create fake high-value targets, such as disguised databases, applications, and servers, to attract attackers to perform further operations. By simulating the real operating system and application environment, the attack trap module can record every step of the attacker's operation and analyze its methods and tools in detail. By integrating multiple honeypot nodes, a complex and multi-level trapping network is formed. This networked management method allows the honeypot system to cover a wider range of attack surfaces and provide more comprehensive monitoring and defense capabilities. The attacker's behavior trajectories between different nodes can be fully recorded and analyzed, providing more detailed attack paths and strategy data.

[0151] 7) The system can obtain and apply the latest attack intelligence data in real time, maintain the advancement of network feature analysis strategies, and dynamically adjust the ability to enable the active trapping system to quickly respond to new threats and provide more effective defense. Compared with existing active trapping solutions, it is more proactive and flexible, can more effectively capture and analyze advanced persistent threats, and provide more comprehensive and timely protection for network security.

[0152] like Figure 8 FIG. 1 is a schematic diagram of the structure of an active trapping device based on network feature analysis provided by an embodiment of the present invention, referring to FIG. Figure 8 The embodiment of the present invention provides an active trapping device based on network feature analysis, including a traffic orchestration module, a network feature analysis module, an attack trapping module, a dynamic simulation module, a honeynet management module and a threat intelligence module, wherein:

[0153] The traffic orchestration module is used to perform traffic mirroring on the access traffic data to obtain traffic mirroring data, and send the traffic mirroring data to the network feature analysis module. It is also used to perform traffic orchestration on the traffic mirroring data according to the traffic detection result returned by the network feature analysis module, so that suspected malicious traffic is forwarded to the attack trapping module;

[0154] The network feature analysis module is used to perform traffic detection on the traffic mirror data based on the malicious IP intelligence library and the attack feature intelligence library, and return the traffic detection results to the traffic orchestration module;

[0155] The attack trapping module is used to redirect suspected malicious traffic to the dynamic simulation module;

[0156] The dynamic simulation module is used to trap suspected malicious traffic and output the trapping results to the honeynet management module;

[0157] The honeynet management module is used to summarize and analyze the trapping results to obtain local intelligence data, and send the local intelligence data to the threat intelligence module;

[0158] The threat intelligence module is used to generate intelligence-enabled data based on cloud intelligence data and local intelligence data, and to update the malicious IP intelligence library and attack feature intelligence library based on the intelligence-enabled data.

[0159] The contents of the above method embodiments are all applicable to the present device embodiments. The functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0160] The embodiment of the present invention also provides an electronic device, which includes: a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory, and when the program is executed by the processor, the above-mentioned active trapping method based on network feature analysis is realized. The electronic device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0161] like Fig. 9 FIG. 1 is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present invention, referring to FIG. Fig. 9 , an embodiment of the present invention provides an electronic device, including:

[0162] The processor 901 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present invention;

[0163] The memory 902 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 902 can store an operating system and other application programs. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 902, and the processor 901 calls and executes the active trapping method based on network feature analysis of the embodiment of the present invention;

[0164] Input / output interface 903, used to implement information input and output;

[0165] Communication interface 904, used to realize communication interaction between the device and other devices, which can be realized by wired mode (such as USB, network cable, etc.) or wireless mode (such as mobile network, WIFI, Bluetooth, etc.);

[0166] A bus 905 that transmits information between the various components of the device (e.g., the processor 901, the memory 902, the input / output interface 903, and the communication interface 904);

[0167] The processor 901 , the memory 902 , the input / output interface 903 and the communication interface 904 are connected to each other in communication within the device via a bus 905 .

[0168] like Fig.10FIG. 1 is a schematic diagram of a storage medium according to an embodiment of the present invention. Fig.10 The embodiment of the present invention further provides a storage medium, which is a computer-readable storage medium used for computer-readable storage. The storage medium stores one or more programs 1001, and the one or more programs 1001 can be executed by one or more processors to implement the above-mentioned active trapping method based on network feature analysis.

[0169] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0170] The embodiment of the present invention also discloses a computer program product or a computer program, wherein the computer program product or the computer program includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes Figure 1 The method shown.

[0171] In some selectable embodiments, the function / operation mentioned in the block diagram may not occur in the order mentioned in the operation diagram. For example, depending on the function / operation involved, the two boxes shown in succession can actually be executed substantially simultaneously or the above-mentioned boxes can sometimes be executed in reverse order. In addition, the embodiment presented and described in the flow chart of the present invention is provided by way of example, for the purpose of providing a more comprehensive understanding of technology. The disclosed method is not limited to the operation and logic flow presented herein. Selectable embodiments are expected, wherein the order of various operations is changed and the sub-operation of a part for which is described as a larger operation is performed independently.

[0172] In addition, although the present invention is described in the context of functional modules, it should be understood that, unless otherwise specified to the contrary, one or more of the above-mentioned functions and / or features can be integrated into a single physical device and / or software module, or one or more functions and / or features can be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the present invention. More specifically, in view of the properties, functions and internal relationships of the various functional modules in the device disclosed herein, the actual implementation of the module will be understood within the conventional skills of the engineer. Therefore, those skilled in the art can implement the present invention set forth in the claims without excessive experimentation using ordinary techniques. It is also understood that the specific concepts disclosed are merely illustrative and are not intended to limit the scope of the present invention, which is determined by the full scope of the appended claims and their equivalents.

[0173] If the above functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the above methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0174] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0175] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and editable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the above-mentioned program is printed, since the above-mentioned program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or processing in other suitable ways as necessary, and then stored in a computer memory.

[0176] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0177] In the above description of this specification, the description with reference to the terms "one embodiment / example", "another embodiment / example" or "certain embodiments / examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0178] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the claims and their equivalents.

[0179] The above is a specific description of the preferred implementation of the present invention, but the present invention is not limited to the above embodiments. Those skilled in the art may make various equivalent modifications or substitutions without violating the spirit of the present invention. These equivalent modifications or substitutions are all included in the scope defined by the claims of this application.

Claims

1. An active trapping method based on network feature analysis, characterized in that: The following steps are involved: Performing traffic mirroring on the access traffic data through the traffic orchestration module to obtain traffic mirroring data, and sending the traffic mirroring data to the network feature analysis module; Performing flow detection on the flow mirror data according to the malicious IP intelligence library and the attack feature intelligence library through the network feature analysis module, and returning the flow detection result to the flow orchestration module; The traffic orchestration module performs traffic orchestration on the traffic mirror data according to the traffic detection result, so that suspected malicious traffic is forwarded to the attack trapping module; Redirecting the suspected malicious traffic to the dynamic simulation module through the attack trapping module; The suspected malicious traffic is trapped by the dynamic simulation module, and the trapping result is output to the honeynet management module; The honeynet management module summarizes and analyzes the trapping results to obtain local intelligence data, and sends the local intelligence data to the threat intelligence module; The threat intelligence module generates intelligence enabling data based on the cloud intelligence data and the local intelligence data, and updates the malicious IP intelligence library and the attack feature intelligence library based on the intelligence enabling data.

2. The active trapping method based on network feature analysis according to claim 1 is characterized in that: The performing flow detection on the flow mirror data according to the malicious IP intelligence library and the attack feature intelligence library specifically includes: Determine the source IP of the traffic mirror data, perform a matching search on the source IP according to the malicious IP intelligence library, and determine whether the source IP is a malicious IP; When the source IP is a malicious IP, the traffic mirror data is subjected to attack feature detection according to the attack feature intelligence library. If the traffic mirror data has the attack feature, the traffic mirror data is determined to be malicious traffic. If the traffic mirror data does not have the attack feature, the traffic mirror data is determined to be suspected malicious traffic. When the source IP is not a malicious IP, attack feature detection is performed on the traffic mirror data according to the attack feature intelligence library. If the traffic mirror data has the attack feature, the traffic mirror data is determined to be suspected malicious traffic. If the traffic mirror data does not have the attack feature, the traffic mirror data is determined to be real access traffic.

3. The active trapping method based on network feature analysis according to claim 2 is characterized in that: The performing traffic arrangement on the traffic mirroring data according to the traffic detection result specifically includes: Forwarding the real access traffic to the real business system; Forwarding the suspected malicious traffic to the attack trapping module; The malicious traffic is blocked, and the malicious IP corresponding to the malicious traffic is banned.

4. The active trapping method based on network feature analysis according to claim 1 is characterized in that: The dynamic simulation module includes multiple high-simulation honeypots, which are obtained based on the simulation of real business systems. The high-simulation honeypots have multiple exploitable vulnerabilities built in. Multiple high-simulation honeypots imitate real business topology to form a honeynet. The attack trapping module is bound to the service port of the high-simulation honeypot to redirect the suspected malicious traffic to the high-simulation honeypot.

5. The active trapping method based on network feature analysis according to claim 4 is characterized in that: The trapping of the suspected malicious traffic specifically includes: The suspected malicious traffic is trapped by using the built-in exploitable vulnerability of the high-simulation honeypot, and the suspected malicious traffic is monitored for attack behaviors; When the suspected malicious traffic contains attack behavior, an alarm log is recorded, and sample analysis and attack traffic source tracing are performed on the suspected malicious traffic to obtain an analysis log and an original traffic log.

6. The active trapping method based on network feature analysis according to claim 5 is characterized in that: The local intelligence data obtained by summarizing and analyzing the trapping results specifically includes: Merge the alarm logs output by the multiple high-simulation honeypots to obtain the attack start time, attack end time, attack target IP and attack type; Perform correlation analysis on the analysis logs output by the multiple high-simulation honeypots to obtain the attack source IP and the attack tool used by the attacker; Tracing the original traffic logs output by the multiple high-simulation honeypots to obtain the attacker's personal ID, device fingerprint, and device MAC; An attacker portrait is generated according to the personal ID, the device fingerprint, the device MAC, the attack source IP, the attack tool, the attack start time, the attack end time, the attack target IP and the attack type, and the attacker portrait is used as the local intelligence data.

7. An active trapping method based on network feature analysis according to any one of claims 1 to 6, characterized in that: Generate intelligence enabling data according to the cloud intelligence data and the local intelligence data, and update the malicious IP intelligence library and the attack feature intelligence library according to the intelligence enabling data, which specifically includes: Get cloud intelligence data in real time; Determine the attacker's source IP and attack feature data based on the cloud intelligence data and the local intelligence data; The attacker source IP and the attack feature data are sent as the intelligence enabling data to the network feature analysis module, so that the network feature analysis module updates the malicious IP intelligence library according to the attacker source IP, and updates the attack feature intelligence library according to the attack feature data.

8. An active trapping device based on network feature analysis, characterized in that: It includes traffic orchestration module, network feature analysis module, attack trapping module, dynamic simulation module, honeynet management module and threat intelligence module, among which: The traffic orchestration module is used to perform traffic mirroring on the access traffic data to obtain traffic mirroring data, and send the traffic mirroring data to the network feature analysis module, and is also used to perform traffic orchestration on the traffic mirroring data according to the traffic detection result returned by the network feature analysis module, so that suspected malicious traffic is forwarded to the attack trapping module; The network feature analysis module is used to perform flow detection on the flow mirror data according to the malicious IP intelligence library and the attack feature intelligence library, and return the flow detection result to the flow orchestration module; The attack trapping module is used to redirect the suspected malicious traffic to the dynamic simulation module; The dynamic simulation module is used to trap the suspected malicious traffic and output the trapping result to the honeynet management module; The honeynet management module is used to summarize and analyze the trapping results to obtain local intelligence data, and send the local intelligence data to the threat intelligence module; The threat intelligence module is used to generate intelligence enabling data based on the cloud intelligence data and the local intelligence data, and to update the malicious IP intelligence library and the attack feature intelligence library based on the intelligence enabling data.

9. An electronic device, characterized in that: The electronic device includes a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory. When the program is executed by the processor, the steps of the active trapping method based on network feature analysis as described in any one of claims 1 to 7 are realized.

10. A storage medium, the storage medium being a computer-readable storage medium, used for computer-readable storage, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the active trapping method based on network feature analysis as described in any one of claims 1 to 7.

Images