Social engineering attack defense method based on honeypot

Abstract

The invention provides a social engineering attack defense method based on a honey pot, which comprises the following steps: based on the characteristics of text data and image data, respectively utilizing a text generation model and an image generation model to make bait data for cheating an attacker, and leaving a visually invisible honey mark on the bait data to obtain honey mark data; based on a natural language processing classification model, an SE attack detector is arranged at an external interaction interface of a system needing to be protected; the system external interaction interface provides real data for visitors and provides honey mark data for attackers; a honey mark data detector is arranged at a service entrance of the system and is used for detecting suspected attackers; and guiding the communication data packet of the suspected attacker to a honeypot. According to the method, a honeypot system for defending the SE attack is constructed, and false data is used for cheating an SE attacker, so that the whole advanced persistent threat attack is destroyed, and meanwhile, a target organization is helped to capture activity records of the attacker.

Description

Technical Field

[0001] The invention belongs to the technical field of network security and relates to a social engineering attack defense method based on a honeypot. Background Art

[0002] The Cyber ​​Kill Chain (CKC) model is an effective method for studying Advanced Persistent Threat (APT) attacks. The CKC model includes seven stages: reconnaissance and tracking, weapon construction, payload delivery, vulnerability exploitation, installation and implantation, command and control, and action on the target. Among these stages, reconnaissance is the primary stage, which aims to collect information about the target for subsequent stages. In other words, if APT opponents want to achieve successful intrusion, they must obtain enough valuable intelligence in the early stage and then customize weapons based on the intelligence. Although the target organization may have released some low-value or non-sensitive information, collecting the remaining privacy or sensitive information still requires the opponent to infiltrate the target, for example, using social engineering (SE) techniques to deceive employees of the target enterprise / organization.

[0003] In fact, SE attacks have defeated most security solutions that successfully defend against other intrusion techniques, and existing conceptual-level research on deceptive defenses shows that by tricking attackers and malicious applications into exposing themselves, researchers can design effective protection measures.

[0004] Existing social engineering attack defense methods mainly mechanically replace part of the information in the text to achieve the purpose of privacy protection and bait making. However, their drawback is how to ensure the sentence readability, semantic integrity and correctness of the bait text. In addition, there are almost no bait making solutions for image data.

[0005] In summary, the current defense measures against social engineering attacks still lack a set of effective deceptive defense countermeasures to protect the system from social engineering attacks. Summary of the invention

[0006] The purpose of the present invention is to provide a social engineering attack defense method based on a honeypot to address the problems existing in the prior art, thereby solving the problem that the existing defense measures against social engineering attacks cannot guarantee the sentence readability, semantic integrity and correctness of the bait text, and lack the bait production for image information.

[0007] To this end, the present invention adopts the following technical solutions: A social engineering attack defense method based on honeypot includes the following steps: Step 1: Build a bait generation system, which uses a deep learning model to create text or image bait files and stamp a secret mark that is almost imperceptible to the eye; including: using a text generation model and an image generation model to create honey seal data for deceiving attackers based on the characteristics of text data and image data, and leaving a secret mark on the honey seal data.

[0008] Specifically, the step 1 includes: Use real sensitive data as training sets for generative neural networks to train text and image generative neural networks; Random noise is input into the generative neural network to obtain the decoy data output by the neural network. Since the input data does not contain any valid sensitive information, it can be considered that the output decoy data has the characteristics of being similar to the sensitive data structure and does not contain sensitive information; In order to distinguish honey-printed data from real sensitive information, a secret seal is added to text honey-printed data and image honey-printed data. If the secret seal exists, it is determined to be honey-printed data; the honey seal of text honey-printed data is the data itself or part of the data itself, and the honey seal of image honey-printed data is the shape of a low-pass filter in the frequency domain image; The steps of adding honeymark in step 1 are as follows: According to the method based on perturbing the original text word vector and perturbing the hidden layer output of the neural network, the text-like bait data is made into text-like honeyprint data; wherein: Perturbing the original text word vector means adding random noise to the word vector of the word unit, and generating a new word unit from the perturbed word vector, thereby achieving the purpose of protecting the privacy of the text content and generating text-like honey-printed data; Perturbing the hidden layer output of the neural network refers to adding random noise to the hidden layer output of the text generation model neural network, thereby achieving the purpose of text structure privacy protection to generate text-like honey-printed data; According to the image generation model, the image data is made into image honeyprint data, which means that the sensitive data itself is used as the training data set of the image generation model, and the feature quantity that the system user subjectively expects to be hidden is selected through the truncation threshold parameter of the image generation model to generate image decoy data; including: Performing a fast Fourier transform on a certain layer or multiple layers of the image-like bait data to obtain a frequency domain image of the bait data. Since the frequency domain image is centrally symmetrical, in order to prevent damage to the image content, a centrally symmetrical low-pass filter is used to process the frequency domain image of the bait data to obtain a frequency domain image of the honey-printed image. Performing an inverse fast Fourier transform on the frequency domain image of the honey-printed image to obtain image-like honey-printed data. Among them, the high-frequency components in the frequency domain graph correspond to the parts of the original image where the pixels change significantly, and the low-frequency components in the frequency domain graph correspond to the parts of the original image where the pixels change slowly. The honeymark of image-type honeymarked data refers to the traces of low-pass filter processing in the frequency domain graph, that is, the image shape of the low-pass filter used.

[0009] Step 2: Build an attack detection system that uses a natural language processing classification model to discover potential social engineering attacks in natural language; including: Step 2a: Set up an attack detector at the external interaction interface of the data system to be protected to detect SE attacks and discover SE attackers; Specifically, the classification model for natural language processing in step 2a may be any machine learning classification model, including but not limited to support vector machines, logistic regression models, and decision trees; Step 2b: Provide real data to the visitor and honeymark data to the attacker; including: For visitors, the data system provides the information they need according to the predetermined functions; For the attacker marked in step 2, the data system will not forcibly terminate the interaction process between the system and the attacker, but will provide the attacker with the honeyprint data produced based on step 1.

[0010] Step 3: Build a honeypot defense system, including: Step 3a: Setting a honey data detector at the service entrance of the data system to detect suspected attackers; including: For text data, the honey seal data detector is built based on the string matching algorithm to retrieve whether the input data contains the honey seal in step 1; For image data, the honeyprint data detector uses the same image processing steps as adding honeyprints, performs a fast Fourier transform on a specific layer, and detects whether there is a centrosymmetric low-pass filter image shape used when adding honeyprints in the frequency domain image; Step 3b: Direct the communication data packets of the suspected attacker to the honeypot to prevent the attacker from accessing the real service system and collecting its attack data.

[0011] The beneficial effects of the present invention are: The present invention can improve the deceptiveness of honeypot bait, effectively protect the system from social engineering attacks and collect the attacker's attack behavior. Specifically, the present invention proposes a method called "honeyprint" to deceive SE attackers in the APT reconnaissance phase. When the attacker uses the honeyprint data, the SE attack can be identified according to the honeyprint. The present invention constructs a honeypot system that defends against SE attacks and uses false data to deceive SE attackers, thereby destroying the entire APT attack, and also helps the target organization capture the attacker's activities. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 is a system architecture diagram of an embodiment of the present invention; Figure 2 This is a flow chart of making text honey-printed data in step 1 of an embodiment of the present invention; Figure 3 This is a flow chart of making image honey-printed data in step 1 of an embodiment of the present invention; Figure 4 The image honey-printed data after adding the secret seal in step 1 of the embodiment of the present invention; Figure 5 Schematic diagram of the process of step 2 of the embodiment of the present invention; Figure 6 Schematic diagram of the process of step 3 of the embodiment of the present invention. DETAILED DESCRIPTION

[0013] The technical solution of the present invention is described below in conjunction with the accompanying drawings and implementation methods.

[0014] Since SE attacks occurring during the reconnaissance phase have serious consequences, one of the effective defense methods is to preemptively disrupt the attacker's reconnaissance, especially to deceive the SE attacker. Since in most cases SE attackers use natural language-based interactions to obtain sensitive information of the victim, one of the effective defense methods for defenders is to use the interaction process to provide false intelligence to the SE attacker, which further causes the APT attacker to make unwise decisions.

[0015] Honeypots are natural tools for performing deceptive defense. They are security resources composed of baits and traps. Their value lies in being scanned, attacked, and captured. Honeypots do not provide any services to external users. All network traffic in and out of the honeypot is illegal and may indicate a scan or attack. The core value of honeypots lies in monitoring, detecting, and analyzing these illegal activities.

[0016] Based on the above technical ideas, the present invention provides a social engineering attack defense method based on honeypot, comprising the following steps: Step 1: Figure 1 As shown, a bait generation system is constructed, which uses a deep learning model to create text or image bait files and stamps a secret mark that is almost imperceptible to the naked eye, including: targeting the characteristics of text data and image data, using a text generation model and an image generation model to respectively create bait data for deceiving attackers, and leaving a secret mark on the bait data to obtain honeymark data.

[0017] Specifically, the step 1 includes: Use real sensitive data as training sets for generative neural networks to train text and image generative neural networks; Random noise is input into the generative neural network to obtain the decoy data output by the neural network. Since the input data does not contain any valid sensitive information, it can be considered that the output decoy data has the characteristics of being similar to the sensitive data structure and does not contain sensitive information; In order to distinguish honey-printed data from real sensitive information, a secret seal is added to text-type honey-printed data and image-type honey-printed data. If the honey seal exists, it is determined to be honey-printed data; among which, the honey seal of text-type honey-printed data is the data itself or part of the data itself, and the honey seal of image-type honey-printed data is the shape of a low-pass filter in the frequency domain image.

[0018] The steps of adding honeymark in step 1 are as follows: According to the method based on perturbing the original text word vector and perturbing the hidden layer output of the neural network, the text-like bait data is made into text-like honeyprint data; wherein: Perturbing the original text word vector means adding random noise to the word vector of the word unit, and generating a new word unit from the perturbed word vector, thereby achieving the purpose of protecting the privacy of the text content and generating text-like honey-printed data; Perturbing the hidden layer output of the neural network refers to adding random noise to the hidden layer output of the text generation model neural network, thereby achieving the purpose of text structure privacy protection to generate text-like honey-printed data; According to the image generation model, the image data is made into image honeyprint data, which means that the sensitive data itself is used as the training data set of the image generation model, and the feature quantity that the system user subjectively expects to be hidden is selected through the truncation threshold parameter of the image generation model to generate image decoy data; including: Performing a fast Fourier transform on a certain layer or multiple layers of the image-like bait data to obtain a frequency domain image of the bait data. Since the frequency domain image is centrally symmetrical, in order to prevent damage to the image content, a centrally symmetrical low-pass filter is used to process the frequency domain image of the bait data to obtain a frequency domain image of the honey-printed image. Performing an inverse fast Fourier transform on the frequency domain image of the honey-printed image to obtain image-like honey-printed data. Among them, the high-frequency components in the frequency domain graph correspond to the parts of the original image where the pixels change significantly, and the low-frequency components in the frequency domain graph correspond to the parts of the original image where the pixels change slowly. The honeymark of image-type honeymarked data refers to the traces of low-pass filter processing in the frequency domain graph, that is, the image shape of the low-pass filter used.

[0019] like Figure 2As shown, according to the method based on perturbing the original text word vector and perturbing the hidden layer output, the text data is made into text honey data; wherein, perturbing the original text word vector refers to adding random noise to the word vector of the word unit, and generating a new word unit from the perturbed word vector, thereby achieving the purpose of word unit replacement to generate text honey data; perturbing the hidden layer output refers to adding random noise to the hidden layer output of the text generation model neural network to generate random text similar to but not identical to the original text, so as to generate text honey data; like Figure 3 As shown, according to the image generation model, the image data is made into image honeyprint data, which means that the sensitive data itself is used as the training data set of the image generation model, the quality and diversity of the generated image are controlled by the truncation threshold parameter of the image generation model, and the feature quantity that the system user subjectively expects to be hidden is selected to generate image honeyprint data.

[0020] The image generation model can arbitrarily select an image generation deep learning neural network model, including GAN, VAE, Diffusion, etc. In this embodiment, the image generation model chooses to use the BigGAN model proposed by Google in 2019.

[0021] In the BigGAN model, z is the initial noise, and z obeys the standard normal distribution z∼N(0,1). By sampling from the prior distribution z, the sampling of z is truncated by setting a threshold, where the values ​​out of range are resampled to fall within the range. As the threshold decreases, the quality of the generated image will get better and better, but as the threshold decreases and the sampling range narrows, the generation orientation will be single, resulting in insufficient diversity. That is, the larger the threshold, the fewer effective features of the generated image exposed to the attacker, but the worse the quality of the generated image, the smaller the threshold, the more effective features of the generated image exposed to the attacker, and the better the quality of the generated image.

[0022] The image generation performance of the BigGAN model is evaluated based on two indicators: IS (Inception Score) and FID (Frechet Inception Distance score); IS is used to judge whether the generated image is clear, and FID is used to evaluate whether the generated distribution is close to the real image distribution.

[0023] In this embodiment, the steps of adding a secret seal to image honey seal data are as follows: First, select any layer of the decoy image A and perform fast Fourier transform to obtain the frequency domain image B; Secondly, the frequency domain image B is passed through a low-pass filter to obtain image C, wherein the low-pass filter selected is a regular hexagon; Finally, perform inverse fast Fourier transform on image C to obtain honey-printed image D, as shown in Figure 4 As shown, the regular hexagon shown in the image D is the secret seal of the image-type honey seal data in this embodiment; if the honey seal is to be analyzed, the image D can be subjected to a fast Fourier transform.

[0024] Step 2: Figure 5 As shown, an attack detection system is constructed to discover potential social engineering attacks in natural language. Based on the classification model of natural language processing, an attack detector is set at the external interaction interface of the data system that needs to be protected. The attack detector is used to detect SE attacks and discover SE attackers.

[0025] Specifically, the classification model for natural language processing in step 2 can be any machine learning classification model, including but not limited to support vector machines, logistic regression models and decision trees.

[0026] Specifically, the step 2 includes: Step 2a: Set up a honeymark data detector at the service entrance of the data system to mark suspected attackers, including: For text data, the honeymark data detector is built based on a string matching algorithm to retrieve whether the input data contains the honeymark in step 1; For image data, the honeyprint data detector uses the same image processing steps as adding honeyprints, performs a fast Fourier transform on a specific layer, and detects whether there is a centrally symmetric low-pass filter image shape used when adding honeyprints in the frequency domain image.

[0027] Specifically, the low-pass filter can use any centrally symmetrical image, including a circle, a square, or a company logo; Step 2b: Provide real data to the visitor and provide honeymarked data to the attacker.

[0028] Step 3: Figure 6 As shown, build a honeypot defense system, including: Step 3a: Setting a honey data detector at the service entrance of the data system to detect suspected attackers; including: For text data, the honey seal data detector is built based on the string matching algorithm to retrieve whether the input data contains the honey seal in step 1; For image data, the honeyprint data detector uses the same image processing steps as adding honeyprints, performs a fast Fourier transform on a specific layer, and detects whether there is a centrosymmetric low-pass filter image shape used when adding honeyprints in the frequency domain image; Step 3b: Direct the communication data packets of the suspected attacker to the honeypot to prevent the attacker from accessing the real service system and collecting its attack data.

Claims

1. A social engineering attack defense method based on honeypot, characterized in that: The steps include: Step 1: Build a bait generation system, which uses a deep learning neural network model to create text or image bait files and stamp them with a secret seal; including: According to the characteristics of text data and image data, the text generation model and the image generation model are used to create bait data for deceiving attackers, and honeymarks are stamped on the bait data to obtain honeymarked data; Step 2: Build an attack detection system that uses a natural language processing classification model to discover potential social engineering attacks in natural language; including: Step 2a: Set up an attack detector at the external interaction interface of the data system to be protected to detect SE attacks and discover SE attackers; Step 2b: Provide real data to the visitor and honeymark data to the attacker; Step 3: Build a honeypot defense system, including: Step 3a: Set up a honey data detector at the service entrance of the data system to detect suspected attackers; Step 3b: Direct the communication data packets of the suspected attacker to the honeypot to prevent the attacker from accessing the real service system and collecting its attack data.

2. A method for defending against social engineering attacks based on honeypot according to claim 1, characterized in that: The step 1 comprises: In order to distinguish honey-printed data from real sensitive information, a secret seal is added to text honey-printed data and image honey-printed data. If the secret seal exists, it is determined to be honey-printed data; the honey seal of text honey-printed data is the data itself or part of the data itself, and the honey seal of image honey-printed data is the shape of a low-pass filter in the frequency domain image; Specifically, the steps of adding honeymark in step 1 are as follows: According to the method based on perturbing the original text word vector and perturbing the hidden layer output of the neural network, the text-like bait data is made into text-like honeyprint data; wherein: Perturbing the original text word vector means adding random noise to the word vector of the word unit, and generating a new word unit from the perturbed word vector, thereby achieving the purpose of protecting the privacy of the text content and generating text-like honey-printed data; Perturbing the hidden layer output of the neural network refers to adding random noise to the hidden layer output of the text generation model neural network, thereby achieving the purpose of text structure privacy protection to generate text-like honey-printed data; According to the image generation model, the image data is made into image honeyprint data, which means that the sensitive data itself is used as the training data set of the image generation model, and the feature quantity that the system user subjectively expects to be hidden is selected through the truncation threshold parameter of the image generation model to generate image decoy data; including: Performing a fast Fourier transform on a certain layer or multiple layers of the image-like bait data to obtain a frequency domain image of the bait data. Since the frequency domain image is centrally symmetrical, in order to prevent damage to the image content, a centrally symmetrical low-pass filter is used to process the frequency domain image of the bait data to obtain a frequency domain image of the honey-printed image. Performing an inverse fast Fourier transform on the frequency domain image of the honey-printed image to obtain image-like honey-printed data. Among them, the high-frequency components in the frequency domain graph correspond to the parts of the original image where the pixels change significantly, and the low-frequency components in the frequency domain graph correspond to the parts of the original image where the pixels change slowly. The honeymark of image-type honeymarked data refers to the traces of low-pass filter processing in the frequency domain graph, that is, the image shape of the low-pass filter used.

3. A method for defending against social engineering attacks based on honeypot according to claim 1, characterized in that: The step 3a comprises: For text data, the honeymark data detector is built based on the string matching algorithm to retrieve whether the input data contains the honeymark in step 1; For image data, the honeyprint data detector uses the same image processing steps as adding honeyprints, performs a fast Fourier transform on a specific layer, and detects whether there is a centrally symmetric low-pass filter image shape used when adding honeyprints in the frequency domain image.

4. A method for defending against social engineering attacks based on honeypot according to claim 1, characterized in that: The step 2b comprises: For visitors, the data system provides the information they need according to the predetermined functions; For the attacker marked in step 2, the data system will not forcibly terminate the interaction process between the system and the attacker, but will provide the attacker with the honeyprint data produced based on step 1.

5. The method for defending against social engineering attacks based on honeypot according to claim 1, characterized in that: The classification model for natural language processing in step 2a may be any machine learning classification model, including but not limited to support vector machines, logistic regression models, and decision trees.

Images