Tracing deterrence method and system based on floating code honey hole

Abstract

The invention provides a traceability deterrence method based on floating code honey holes, which relates to the technical field of network security attack traceability, and comprises the following steps: capturing and processing network traffic to obtain multi-dimensional information; constructing an initial model, extracting multi-dimensional information features to train the initial model to obtain a portrait model, and inputting the verification set into the portrait model to generate an attacker portrait; a honey hole program is generated based on an attacker portrait, an attacker is required to perform forced installation, and a real identity verification scene is simulated based on the honey hole program to frighten the access of the attacker; the honey hole program can generate floating codes according to different attack stages and different attack techniques of an attacker, the honey hole program is updated in a hot patch mode to conduct real-time monitoring and tracing, real-time information is collected, tracing analysis is conducted based on a deterrent event and the real-time information, and a tracing deterrent report is generated. The invention aims to improve the problems in the aspects of pertinence, flexibility, real-time performance and deterrent force in the prior art, so that network attacks can be defended and countered more effectively.

Description

Technical Field

[0001] The present invention relates to the technical field of network security attack source tracing, and in particular to a source tracing deterrence method and system based on a floating code honey hole. Background Art

[0002] As cyberattacks continue to evolve, especially advanced persistent threats (APTs) and complex multi-stage attacks have become common security challenges, traditional network defense technologies have gradually exposed their shortcomings. Attackers are often able to bypass traditional security measures such as firewalls and intrusion detection systems, sneak into the target network, and wait for opportunities to steal sensitive data or destroy critical infrastructure.

[0003] To meet this challenge, the concept of active defense came into being. Its core idea is to actively interact with attackers, collect attacker information, trace the source of attacks, and ultimately achieve effective countermeasures. Honeypot technology, as an active deception defense method, has been widely used and developed under the guidance of the active defense concept. By deploying bait systems or services, honeypot technology can attract attackers to interact with them, thereby collecting attacker information, analyzing attack behaviors, and tracing the source of attacks.

[0004] However, traditional honeypot tracing technology has obvious limitations: lack of pertinence and flexibility, resulting in poor tracing efficiency and deterrence effect when facing complex and changing network attacks, as follows:

[0005] (1) Existing technologies lack specificity, resulting in low traceability efficiency: Traditional traceability technologies usually rely on general rules and feature matching, which makes it difficult to conduct targeted analysis of the features and attack stages of different attackers. This leads to the generalization of the collected information, making it difficult to effectively identify the attacker's identity and attack intentions, thereby reducing the traceability efficiency.

[0006] (2) Existing technologies lack flexibility and are difficult to adapt to complex attack scenarios: Traditional tracing technologies find it difficult to dynamically adjust tracing strategies based on attacker behavior and attack stages. In the face of complex and changing attack scenarios, it is difficult to effectively collect and correlate attacker behavior information, which reduces the success rate of tracing.

[0007] (3) Existing tracing technology lacks real-time performance and is difficult to capture the real-time behavior of attackers: Traditional tracing technology often relies on post-analysis of logs and traffic data and is unable to track the attacker's behavior in real time, which easily leads to missing the best tracing opportunity.

[0008] (4) Existing traceability technologies generally lack deterrence capabilities and are unable to effectively prevent attacks: Traditional traceability technologies are mainly aimed at post-event accountability and lack the ability to effectively intervene in and prevent ongoing attacks.

[0009] Therefore, it is urgent to develop a solution to improve the above problems. Summary of the invention

[0010] The purpose of the present invention is to provide a source tracing deterrence method and system based on floating code honeyhole, aiming to improve the problems of existing source tracing technology in terms of targeting, flexibility, real-time and deterrence capability, so as to more effectively defend and counter network attacks.

[0011] The present invention provides a source tracing deterrence method and system based on floating code honeyhole, which adopts the following technical solutions:

[0012] First, a source tracing deterrence method based on floating code honeyholes specifically includes:

[0013] Capture network traffic, extract information, and then preprocess to obtain multi-dimensional information;

[0014] Build an initial model, extract multi-dimensional information features and divide them into training set, test set and validation set. Train and test the initial model based on the training set and test set to obtain a portrait model. Input the validation set into the portrait model to generate an attacker portrait.

[0015] Generate a honeyhole program based on the attacker's profile and force the attacker to install it. Use the honeyhole program to simulate a real identity authentication scenario to deter the attacker from accessing. If the attacker continues to access, generate floating code based on the attacker's profile and package it into a hot patch. Use the hot patch to update the honeyhole program.

[0016] Based on the updated honeyhole program, attackers are monitored in real time and real-time information is collected. Based on deterrence events and real-time information, source tracing analysis is performed to generate a source tracing deterrence report.

[0017] The beneficial effects of the source tracing deterrence method based on floating code honeyhole provided by the present invention are:

[0018] (1) Dynamically generate and deliver targeted floating codes based on attacker characteristics and attack stages, thus achieving a floating code traceability mechanism that is tailored to each individual, thereby improving traceability efficiency and targeting.

[0019] (2) By forcibly installing the honeyhole program and dynamically updating the floating code using hot patching technology in the later stage, the flexibility and real-time performance of traceability are enhanced.

[0020] (3) Simulate real identity authentication scenarios, forcing attackers to provide identity credentials or install honeyhole programs, thereby increasing the cost of attack and the risk of tracing the source, effectively deterring attackers and causing them to voluntarily stop the attack.

[0021] (4) Achieve pre-emptive deterrence and post-incident tracing, thereby more effectively defending against and countering cyber attacks.

[0022] Optionally, network traffic is captured and preprocessed to extract information to obtain multi-dimensional information, including:

[0023] Capturing network traffic based on data collection devices deployed at the network border, extracting information, cleaning and formatting the data to obtain multi-dimensional information, and storing the multi-dimensional information in a database or other storage medium;

[0024] The multi-dimensional information includes: network environment information, system information, hardware fingerprint information and attack behavior information.

[0025] Optionally, the initial model is trained and tested based on the training set and the test set to obtain a portrait model, including:

[0026] Initialize the initial model parameters, input the training set into the initial model for forward propagation to obtain the predicted value, calculate the error between the predicted value and the true value and construct the cross entropy loss function, minimize the loss function based on the gradient descent method, iteratively update the model parameters until the loss function tends to a stable value or the maximum number of iterations is reached to end the training, and evaluate and fine-tune the trained initial model based on the test set to obtain the portrait model.

[0027] Optionally, the validation set is input into the portrait model to generate an attacker portrait, including:

[0028] Based on the portrait model, the verification set is clustered and grouped and the risk level is divided, the correlation between different dimensions is mined, and the correlation is converted into quantifiable indicators to construct an attacker portrait.

[0029] Optionally, the portrait model includes a clustering module, a classification module and an association mining module; the clustering module is used to cluster and group the multidimensional information data, the classification module is used to classify the grouped data into risk levels, and the association mining module is used to mine the association relationship between different dimensions of the classified data and construct an attacker portrait.

[0030] Optionally, when a honeyhole program is generated based on an attacker's portrait and the attacker is required to forcibly install the program, in order to force the attacker to install the honeyhole program, the system will intercept suspicious access requests and require the user to install the honeyhole program in various ways before continuing to access the program.

[0031] Optionally, when the attacker continues to access, a floating code is generated based on the attacker's profile and packaged into a hot patch, and the honeyhole program is updated based on the hot patch, including:

[0032] Different tracing functions are encapsulated into independent code modules including information collection module, keyboard recording module, and screenshot module. Different independent code modules are selected for combination according to the attacker portrait and attack stage, and the code is obfuscated to generate the final floating code. The floating code is packaged into a hot patch file, and the honeyhole program is updated based on the hot patch technology.

[0033] Optionally, when the honeyhole program is updated based on hot patch technology, the honeyhole program utilizes hot patch technology to dynamically load the floating code into the program and execute it without the user restarting the program. The updated honeyhole program records user information in real time and uploads the recorded user data to the server.

[0034] Optionally, a source tracing analysis is performed based on deterrence events and real-time information to generate a source tracing deterrence report, including:

[0035] Based on deterrence events and real-time information, the attacker's behavior trajectory is restored to identify the attacker's identity, motives and attack methods, and a traceability report is generated in combination with the data of the open source threat intelligence platform. Finally, a traceability deterrence report containing deterrence events and traceability reports is generated.

[0036] The deterrent event includes refusing to provide identity credentials or refusing to install the honeyhole program, and the real-time information includes visited web pages, executed commands and keyboard records.

[0037] The second aspect is a traceability deterrence system based on floating code honeyhole, which specifically includes:

[0038] A data processing module is used to capture network traffic, extract information, and then pre-process to obtain multi-dimensional information;

[0039] The portrait generation module is used to build an initial model, extract multi-dimensional information features and divide them into training set, test set and validation set, train and test the initial model based on the training set and test set to obtain a portrait model, and input the validation set into the portrait model to generate an attacker portrait;

[0040] The honeyhole program tracing module generates a honeyhole program based on the attacker's profile and requires the attacker to install it. The module simulates a real identity authentication scenario based on the honeyhole program to deter the attacker from accessing the program. If the attacker continues to access the program, the module generates a floating code based on the attacker's profile and packages it into a hot patch. The honeyhole program is updated based on the hot patch.

[0041] The data analysis module monitors attackers in real time and collects real-time information based on the updated honeyhole program, performs source tracing analysis based on deterrence events and real-time information, and generates a source tracing deterrence report.

[0042] The beneficial effects of the second aspect can refer to the description of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 The overall step flow chart of a source tracing deterrence method based on floating code honeyhole provided by the present invention;

[0044] Figure 2 A schematic diagram of the data processing module flow of a traceability deterrence system based on a floating code honey hole provided by the present invention;

[0045] Figure 3 A schematic flow chart of a honeyhole program tracing module of a tracing deterrence system based on a floating code honeyhole provided by the present invention. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be understood by people with general skills in the field to which the present invention belongs. "Including" and similar words used in this article mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0047] Definition of noun:

[0048] 1) Honeyhole is an attack deterrence and tracing system deployed in the real network close to the attacker. When it senses abnormal user access, it uses edge multi-level identity authentication or tracing to authenticate the user, such as asking for identity credentials or requiring them to download and execute specific executable code. The role of honeyhole is to deter attackers by increasing the cost of attack and the risk of tracing to make them stop the attack spontaneously.

[0049] 2) Hot patching is a technology that can dynamically repair or update programs without restarting the application or system. It achieves dynamic updates of programs by loading modified code fragments into the runtime environment and injecting them into the memory of the target program, replacing or modifying the original code. Hot patching has the advantages of no need for restart, fast response and flexible expansion.

[0050] The embodiment of the present invention provides a source tracing deterrence method based on floating code honey hole, see Figure 1 , including the following steps:

[0051] S1, capture network traffic, extract information, and then preprocess to obtain multi-dimensional information;

[0052] S2. Build an initial model, extract multi-dimensional information features and divide them into training set, test set and validation set. Train and test the initial model based on the training set and test set to obtain a portrait model. Input the validation set into the portrait model to generate an attacker portrait.

[0053] S3: Generate a honeyhole program based on the attacker's profile and force the attacker to install it. Use the honeyhole program to simulate a real identity authentication scenario to deter the attacker from accessing. If the attacker continues to access, generate floating code based on the attacker's profile and package it into a hot patch. Use the hot patch to update the honeyhole program.

[0054] S4. Based on the updated honeyhole program, real-time tracing and monitoring of attackers are carried out to collect real-time information. Based on deterrence events and real-time information, tracing analysis is performed to generate a tracing deterrence report.

[0055] In some embodiments, see Figure 2 When executing step S1, the network traffic is captured, information is extracted, and then preprocessed to obtain multi-dimensional information, including:

[0056] S1-1, capturing network traffic based on data collection devices deployed at the network edge;

[0057] S1-2, after information extraction, data cleaning and formatting are performed to obtain multi-dimensional information;

[0058] S1-3, storing the multidimensional information in a database or other storage medium;

[0059] Specifically, when executing step S1-1, a honeypot is deployed at a network boundary or in an internal network to capture network traffic.

[0060] Specifically, when executing step S1-2, the multi-dimensional information includes: network environment information, system information, hardware fingerprint information and attack behavior information.

[0061] Furthermore, network environment information, including the attacker's IP address, geographic location, network operator, DNS server, etc., is used to identify the attacker's source and network environment characteristics; system information, including the operating system type, version, patch level, browser type and version, installed software list, etc. used by the attacker, is used to identify the attacker's system vulnerabilities and configuration information; hardware fingerprint information, including the CPU model, memory size, hard disk serial number, graphics card model, etc. used by the attacker, is used to identify the unique identifier of the attacker's device; attack behavior information, including the attacker's access frequency, access path, attack tools used, target system attacked, etc., is used to identify the attacker's attack intentions and attack methods.

[0062] Specifically, when executing step S1-3, the database includes: a relational database, a NoSQL database, an in-memory database, and a distributed database.

[0063] In some embodiments, when executing step S2, it includes:

[0064] S2-1. Build an initial model, extract multi-dimensional information features and divide them into training set, test set and validation set, train and test the initial model based on the training set and test set to obtain a portrait model;

[0065] S2-2. Input the verification set into the portrait model to generate the attacker portrait.

[0066] Specifically, when executing step S2-1, the initial model is trained and tested based on the training set and the test set to obtain the portrait model, including:

[0067] Initialize the initial model parameters, input the training set into the initial model for forward propagation to obtain the predicted value, calculate the error between the predicted value and the true value and construct the cross entropy loss function, minimize the loss function based on the gradient descent method, iteratively update the model parameters until the loss function tends to a stable value or the maximum number of iterations is reached to end the training, and evaluate and fine-tune the trained initial model based on the test set to obtain the portrait model.

[0068] Specifically, when executing step S2-2, the verification set is input into the portrait model to generate the attacker portrait, including:

[0069] Based on the portrait model, the verification set is clustered and grouped and the risk level is divided, the correlation between different dimensions is mined, and the correlation is converted into quantifiable indicators to construct an attacker portrait.

[0070] In fact, the portrait model includes a clustering module, a classification module and an association mining module; the clustering module is used to cluster and group the multidimensional information data, the classification module is used to classify the grouped data into risk levels, and the association mining module is used to mine the association relationship between different dimensions of the classified data and construct an attacker portrait.

[0071] Furthermore, the clustering module uses the K-means clustering algorithm to group attackers with similar characteristics to form different attacker groups; the classification module uses the decision tree classification algorithm to divide attackers into different risk levels according to the degree of harm of the attack behavior, the attacker's technical level, etc.; the association mining module uses the Apriori association rule mining algorithm to mine the association relationship between information of different dimensions, such as the association relationship between attack tools and attack targets, so as to more comprehensively characterize the attacker's characteristics.

[0072] In some embodiments, when executing step S3, it specifically includes:

[0073] S3-1, Generate a honeyhole program based on the attacker's profile and require the attacker to install it by force;

[0074] S3-2, based on the honeyhole program, simulate the real identity authentication scenario to deter attackers from accessing;

[0075] S3-3. When the attacker continues to access, a floating code is generated based on the attacker's profile and packaged into a hot patch, and the honeyhole program is updated based on the hot patch.

[0076] Specifically, when executing step S3-1, a honeyhole program is generated based on the attacker's portrait and the attacker is required to install it by force. In order to force the attacker to install the honeyhole program, the system will intercept suspicious access requests and require the user to install the honeyhole program in various ways before continuing to access.

[0077] Furthermore, the honeyhole program contains basic information collection functions and is small in size, aiming to reduce the vigilance of attackers and increase the possibility of their installation; at the same time, this honeyhole program also serves as the basic framework for subsequent hot patch updates.

[0078] Furthermore, the system interception method includes: pop-up prompt box, web page redirection or disguising the honeyhole program as a necessary software component.

[0079] Specifically, when executing step S3-2, the honeyhole program will simulate a real identity authentication scenario, including requiring the user to provide an ID card, real-name mobile phone number, and mobile phone verification code. This can not only collect the attacker's identity information and behavior data, but also increase the attacker's attack cost and risk of being traced, effectively deterring the attacker.

[0080] Specifically, when executing step S3-3, see Figure 3 When the attacker continues to access, the floating code is generated based on the attacker's profile and packaged into a hot patch. The honeyhole program is updated based on the hot patch, including:

[0081] Different tracing functions are encapsulated into independent code modules including information collection module, keyboard recording module, and screenshot module. Different independent code modules are selected for combination according to the attacker portrait and attack stage, and the code is obfuscated to generate the final floating code. The floating code is packaged into a hot patch file, and the honeyhole program is updated based on the hot patch technology.

[0082] Furthermore, new floating code snippets are dynamically generated according to the attacker's attack behavior and attack stage. For example, in the early stage of the attack, the floating code may only collect some basic information, while in the in-depth stage of the attack, more sensitive information such as keylogging, screenshots, etc. can be collected.

[0083] Furthermore, in order to improve the concealment of the floating code, the floating code generation module can also use code obfuscation technology to confuse the generated code, increasing the difficulty for attackers to analyze the code. In order to adapt to different application scenarios, the floating code generation module supports multiple operating systems and platforms, such as Windows, Linux, etc.

[0084] In fact, when the honeyhole program is updated based on the hot patch technology, the honeyhole program uses the hot patch technology to dynamically load the floating code into the program and execute it without the user restarting the program. The updated honeyhole program records the user's information in real time and uploads the recorded user data to the server.

[0085] Furthermore, by using hot patch technology, the floating code is dynamically updated without restarting the honeyhole program, realizing real-time tracing and continuous monitoring of attackers. This ensures the real-time nature of tracing, improves the concealment of the honeyhole program, and avoids the large size of the program causing vigilance to attackers.

[0086] In other embodiments, when a user visits a website where the device of the present invention is deployed, and downloads and installs the initial honey hole program, the program includes basic system information collection functions and simulated identity authentication. At this time, the program is small in size and simple in function, and is not easy to arouse user suspicion. Assume that the user passes the identity authentication and starts to perform further malicious operations, such as trying to access sensitive directories of the server. The honey hole program will upload these behavior information to the server. The floating code generation module on the server side determines that the user may be in the invasion stage of the attack based on the user's behavior information, so it generates a floating code for recording the user's keyboard input and packages it into a patch file. The hot patch update module sends the patch file to the user's honey hole program. The honey hole program uses hot patch technology to dynamically load the keyboard recording code into the program and execute it without the user restarting the program. The updated honey hole program starts to record the user's keyboard input and uploads the recorded data to the server, providing key evidence for subsequent tracing, and the user will not be aware that the function of the honey hole program has changed at all. This reflects the real-time, concealment and flexibility of the hot patch technology, so that the honey hole program can dynamically adjust the tracing strategy according to the attacker's behavior. If the attacker's behavior changes again, such as attempting to perform privilege escalation operations, the floating code generation module can generate new floating code (such as process monitoring code) again and update it to the honeyhole program through a hot patch, thereby continuously monitoring the attacker's behavior.

[0087] In some embodiments, when executing step S4, it specifically includes:

[0088] S4-1, monitor the attacker in real time and collect real-time information based on the updated honeyhole program;

[0089] S4-2. Conduct source tracing analysis based on deterrence events and real-time information, and generate a source tracing deterrence report.

[0090] Specifically, when executing step S4-1, the attacker is monitored in real time based on the updated honeyhole program and real-time information is collected. The real-time information includes web pages visited by the attacker, executed commands, and keyboard records.

[0091] Furthermore, the updated honeyhole program begins to record the web pages visited by the attacker, the commands executed, and the keystrokes, and uploads the recorded real-time data to the server, providing key evidence for subsequent tracing, while the attacker has difficulty noticing that the function of the honeyhole program has changed.

[0092] Specifically, when executing step S4-2, a source tracing analysis is performed based on the deterrence event and real-time information to generate a source tracing deterrence report, including:

[0093] Based on deterrence events and real-time information, the attacker's behavior trajectory is restored to identify the attacker's identity, motives and attack methods, and a traceability report is generated in combination with the data of the open source threat intelligence platform. Finally, a traceability deterrence report containing deterrence events and traceability reports is generated.

[0094] Furthermore, the deterrent event includes refusing to provide identity credentials or refusing to install the honeyhole program.

[0095] The embodiment of the present invention further provides a source tracing deterrence system based on a floating code honey hole, which specifically includes:

[0096] A data processing module is used to capture network traffic, extract information, and then pre-process to obtain multi-dimensional information;

[0097] The portrait generation module is used to build an initial model, extract multi-dimensional information features and divide them into training set, test set and validation set, train and test the initial model based on the training set and test set to obtain a portrait model, and input the validation set into the portrait model to generate an attacker portrait;

[0098] The honeyhole program tracing module generates a honeyhole program based on the attacker's profile and requires the attacker to install it. The module simulates a real identity authentication scenario based on the honeyhole program to deter the attacker from accessing the program. If the attacker continues to access the program, the module generates a floating code based on the attacker's profile and packages it into a hot patch. The honeyhole program is updated based on the hot patch.

[0099] The data analysis module monitors attackers in real time and collects real-time information based on the updated honeyhole program, performs source tracing analysis based on deterrence events and real-time information, and generates a source tracing deterrence report.

[0100] Although the embodiments of the present invention are described in detail above, it is obvious to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as described in the claims. Moreover, the present invention described herein may have other embodiments and may be implemented or realized in a variety of ways.

Claims

1. A source tracing deterrence method based on floating code honeyhole, characterized in that: include: Capture network traffic, extract information, and then preprocess to obtain multi-dimensional information; Build an initial model, extract multi-dimensional information features and divide them into training set, test set and validation set. Train and test the initial model based on the training set and test set to obtain a portrait model. Input the validation set into the portrait model to generate an attacker portrait. Generate a honeyhole program based on the attacker's profile and force the attacker to install it. Use the honeyhole program to simulate a real identity authentication scenario to deter the attacker from accessing. If the attacker continues to access, generate floating code based on the attacker's profile and package it into a hot patch. Use the hot patch to update the honeyhole program. Based on the updated honeyhole program, attackers are monitored in real time and real-time information is collected. Based on deterrence events and real-time information, source tracing analysis is performed to generate a source tracing deterrence report.

2. A source tracing deterrence method based on floating code honeyhole according to claim 1, characterized in that: Capture network traffic, extract information, and then preprocess to obtain multi-dimensional information, including: Capturing network traffic based on data collection devices deployed at the network border, extracting information, cleaning and formatting the data to obtain multi-dimensional information, and storing the multi-dimensional information in a database or other storage medium; The multi-dimensional information includes: network environment information, system information, hardware fingerprint information and attack behavior information.

3. The source tracing deterrence method based on floating code honey hole according to claim 1 is characterized in that: The initial model is trained and tested based on the training set and test set to obtain the portrait model, including: Initialize the initial model parameters, input the training set into the initial model for forward propagation to obtain the predicted value, calculate the error between the predicted value and the true value and construct the cross entropy loss function, minimize the loss function based on the gradient descent method, iteratively update the model parameters until the loss function tends to a stable value or the maximum number of iterations is reached to end the training, and evaluate and fine-tune the trained initial model based on the test set to obtain the portrait model.

4. The source tracing deterrence method based on floating code honey hole according to claim 1 is characterized in that: Input the validation set into the portrait model to generate the attacker portrait, including: Based on the portrait model, the verification set is clustered and grouped and the risk level is divided, the correlation between different dimensions is mined, and the correlation is converted into quantifiable indicators to construct an attacker portrait.

5. A source tracing deterrence method based on floating code honeyhole according to claim 4, characterized in that: The portrait model includes a clustering module, a classification module and an association mining module; the clustering module is used to cluster and group the multidimensional information data, the classification module is used to classify the grouped data into risk levels, and the association mining module is used to mine the association relationship between different dimensions of the classified data and construct an attacker portrait.

6. The source tracing deterrence method based on floating code honey hole according to claim 1 is characterized in that: When a honeyhole program is generated based on the attacker's profile and the attacker is required to install it, in order to force the attacker to install the honeyhole program, the system will intercept suspicious access requests and require the user to install the honeyhole program in various ways before continuing to access.

7. According to claim 1, a source tracing deterrence method based on floating code honeyhole is characterized in that: When the attacker continues to access, the floating code is generated based on the attacker's profile and packaged into a hot patch. The honeyhole program is updated based on the hot patch, including: Different tracing functions are encapsulated into independent code modules including information collection module, keyboard recording module, and screenshot module. Different independent code modules are selected for combination according to the attacker portrait and attack stage, and the code is obfuscated to generate the final floating code. The floating code is packaged into a hot patch file, and the honeyhole program is updated based on the hot patch technology.

8. The source tracing deterrence method based on floating code honey hole according to claim 7 is characterized in that: When the honey hole program is updated based on the hot patch technology, the honey hole program utilizes the hot patch technology to dynamically load the floating code into the program and execute it without the user restarting the program. The updated honey hole program records the user's information in real time and uploads the recorded user data to the server.

9. The method of tracing source deterrence based on floating code honeyhole according to claim 1, characterized in that: Conduct source tracing analysis based on deterrence events and real-time information to generate a source tracing deterrence report, including: Based on deterrence events and real-time information, the attacker's behavior trajectory is restored to identify the attacker's identity, motives and attack methods, and a traceability report is generated in combination with the data of the open source threat intelligence platform. Finally, a traceability deterrence report containing deterrence events and traceability reports is generated. The deterrent event includes refusing to provide identity credentials or refusing to install the honeyhole program, and the real-time information includes visited web pages, executed commands and keyboard records.

10. A traceability deterrence system based on floating code honeyhole, characterized in that: include: A data processing module is used to capture network traffic, extract information, and then pre-process to obtain multi-dimensional information; The portrait generation module is used to build an initial model, extract multi-dimensional information features and divide them into training set, test set and validation set, train and test the initial model based on the training set and test set to obtain a portrait model, and input the validation set into the portrait model to generate an attacker portrait; The honeyhole program tracing module generates a honeyhole program based on the attacker's profile and requires the attacker to install it. The module simulates a real identity authentication scenario based on the honeyhole program to deter the attacker from accessing the program. If the attacker continues to access the program, the module generates a floating code based on the attacker's profile and packages it into a hot patch. The honeyhole program is updated based on the hot patch. The data analysis module monitors attackers in real time and collects real-time information based on the updated honeyhole program, performs source tracing analysis based on deterrence events and real-time information, and generates a source tracing deterrence report.

Images