SSH honeypot deployment method and system based on flow transfer, and storage medium

Abstract

The invention provides an SSH honeypot deployment method and system based on flow transfer and a storage medium, and relates to the technical field of network security. The SSH honeypot deployment method based on flow transfer comprises the following steps: when an attacker scans a port, redirecting the flow directly accessing an SSH honeypot to an empty port or a non-SSH service port based on a firewall technology, so that only one SSH service port is obtained by scanning; when the user carries out SSH service login, whether the user is a malicious user is judged based on the failure times of the login request of the same IP in a set time window, if the user is judged to be the malicious user, the flow of the IP is forwarded to the SSH honeypot, attack information is captured based on the SSH honeypot, and on the contrary, the real SSH service is provided. According to the method and the device, two flow transfer technologies of flow redirection and flow forwarding are combined, so that the concealment of the honeypot is improved, and the interference to a normal user when using the SSH service is reduced.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a SSH honeypot deployment method, system and storage medium based on traffic transfer. Background Art

[0002] With the rapid development of the Internet, the number and complexity of network attacks are increasing rapidly, such as DDoS attacks, brute force attacks and other threats are increasing day by day. As the most mainstream and widely used remote login and secure file transfer protocol, the SSH (Secure Shell) protocol has to deal with a large number of malicious attacks every day. Hackers use scanning tools such as Nmap to scan ports on hosts, servers, etc. If they find that the target host has an open SSH port, they will use brute force hacking tools such as Hydra to brute force attacks on hosts using the SSH protocol through brute force dictionaries, thereby obtaining user accounts and passwords for subsequent attacks on the target host, such as obtaining data or implanting malware, or even paralyzing the entire network where the host is located.

[0003] SSH honeypot is an active defense technology that simulates SSH service to lure attackers to attack, thereby capturing the attacker's attack behavior and identity information such as the attacker's IP, and performing related defense operations such as blocking the attacker's IP. When an attacker attempts to perform an SSH brute force attack, he will obtain a fake SSH account and password provided by the honeypot, and enter the SSH honeypot through the fake account and password. The SSH honeypot simulates the shell environment to make the attacker think that he is in a real server, so as to collect and analyze the attacker's attack behavior. Although the SSH honeypot can highly capture the attacker's brute force cracking behavior, there is a problem that the honeypot itself is not concealed enough and interferes with the normal user experience. Therefore, it is urgent to provide a solution to improve the above problems. Summary of the invention

[0004] The purpose of the present invention is to provide a SSH honeypot deployment method, system and storage medium based on traffic transfer, which improves the problem of low concealment of SSH honeypot and interference with user experience.

[0005] The present invention provides a method for deploying an SSH honeypot based on traffic transfer, which adopts the following technical solution:

[0006] When an attacker performs a port scan, the firewall technology redirects the traffic directly accessing the SSH honeypot to an empty port or a non-SSH service port, so that only one SSH service port is obtained through the scan.

[0007] When a user logs in to the SSH service, it is determined whether the user is a malicious user based on the number of failed login requests from the same IP in a set time window. If the user is determined to be a malicious user, the traffic of the IP is forwarded to the SSH honeypot, and the attack information is captured based on the SSH honeypot. Otherwise, real SSH service is provided.

[0008] Optionally, the SSH honeypot is deployed on a different port than the SSH service.

[0009] Optionally, the process of redirecting the traffic that directly accesses the SSH honeypot to an empty port or a non-SSH service port based on the firewall technology includes: redirecting the traffic that attempts to directly access the SSH honeypot to an empty port or a non-SSH service port based on the firewall technology, so that the SSH honeypot appears as an unresponsive empty port or a service port unrelated to SSH.

[0010] Optionally, the process of determining whether the user is a malicious user based on the number of failed login requests from the same IP in a set time window includes: detecting the number of failed login requests from the same IP based on the set time window, and when the number of failed login requests from the same IP exceeds a maximum threshold, determining that the user is a malicious user.

[0011] Optionally, when detecting the number of failed login requests from the same IP address based on a set time window, use the following formula:

[0012]

[0013] Here, n(T) refers to the number of failed logins from the same IP within the time window T, and m is the total number of logins from the same IP within T.

[0014] Optionally, the time window limit is set to 0.3 seconds, and the maximum threshold for the number of failed login requests from the same IP address is 5 times.

[0015] Optionally, when a malicious user is determined, the process of forwarding the traffic of the IP to the SSH honeypot includes: when a malicious user is determined, forwarding the traffic of the IP to the SSH honeypot based on a PREROUTING rule of iptables.

[0016] Optionally, the process of executing the iptables-based PREROUTING rule to forward the traffic of the IP to the SSH honeypot includes: adding the malicious user IP to the nat table of iptables, and forwarding the traffic belonging to the malicious user IP to the port where the SSH honeypot service is located.

[0017] In a second aspect of the present invention, a SSH honeypot deployment system based on traffic transfer is provided, including a traffic redirection module and a traffic transfer module, wherein:

[0018] Traffic redirection module: When an attacker performs a port scan, the traffic directly accessing the SSH honeypot is redirected to an empty port or a non-SSH service port based on firewall technology, so that only one SSH service is obtained through the scan;

[0019] Traffic transfer module: When a user logs in to the SSH service, it determines whether the user is a malicious user based on the number of failed login requests from the same IP in the set time window. If the user is determined to be a malicious user, the traffic of the IP will be forwarded to the SSH honeypot, and the attack information will be captured based on the SSH honeypot. Otherwise, real SSH service will be provided.

[0020] In a third aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores instructions, and when the instructions are executed, any of the above methods is executed.

[0021] The present invention provides a method, system and storage medium for deploying SSH honeypot based on traffic transfer, which have the following beneficial effects:

[0022] 1. Based on the firewall technology, the traffic directly accessing the SSH honeypot is redirected. Attackers using port scanning tools will scan out no services or other irrelevant services, which improves the concealment of the honeypot;

[0023] 2. Analyze the behavior pattern of brute force cracking software, set the number of failed login requests from the same IP in a time window to determine whether it is a malicious user, and forward the traffic belonging to the malicious user IP to the SSH honeypot, effectively distinguishing normal users from malicious users and improving user experience.

[0024] 3. Use traffic forwarding technology to eliminate the need to migrate the original SSH service, reduce frequent modifications to SSH configuration files, and reduce management and maintenance costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 A flow chart of a SSH honeypot deployment method based on traffic transfer provided by the present invention;

[0026] Figure 2 A schematic diagram of traffic redirection provided by the present invention;

[0027] Figure 3 A schematic diagram of traffic forwarding provided by the present invention. DETAILED DESCRIPTION

[0028] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be understood by people with general skills in the field to which the present invention belongs. "Including" and similar words used in this article mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0029] The embodiment of the present invention provides a SSH honeypot deployment method based on traffic transfer, see Figure 1 ,include:

[0030] S1. When the attacker performs port scanning, the firewall technology redirects the traffic directly accessing the SSH honeypot to an empty port or a non-SSH service port, so that only one SSH service port is obtained through the scan.

[0031] S2. When a user logs in to the SSH service, it is determined whether the user is a malicious user based on the number of failed login requests from the same IP in a set time window. If the user is determined to be a malicious user, the traffic of the IP is forwarded to the SSH honeypot, and the attack information is captured based on the SSH honeypot. Otherwise, real SSH service is provided.

[0032] In some embodiments, the process of executing step S1 includes:

[0033] S1.1. Deploy SSH honeypot;

[0034] S1.2, redirect the traffic directly accessing the SSH honeypot to an empty port or a non-SSH service port based on firewall technology;

[0035] Specifically, when executing step S1.1 and deploying the SSH honeypot, the SSH honeypot is deployed on a port different from that of the SSH service.

[0036] Furthermore, when the attacker performs a port scan, step S1.2 is executed to redirect the traffic that attempts to directly access the SSH honeypot. The traffic is redirected to an empty port or a non-SSH service port based on firewall technology, so that the SSH honeypot appears as an unresponsive empty port or a service port unrelated to SSH.

[0037] In fact, when the traditional method SSH honeypot and SSH service are in the port at the same time, two SSH services will be scanned by using port scanning tools. It is easy for advanced attackers who are familiar with SSH honeypots to know the existence of SSH honeypots, thus making the SSH honeypot invalid. Since normal users will not use scanning tools to try to scan honeypots, nor will they try to access SSH honeypots, all traffic that attempts to directly enter the honeypot port is redirected to prevent the honeypot service from being exposed and discovered by attackers.

[0038] Furthermore, by redirecting the traffic that directly accesses the SSH honeypot, the risk of honeypot exposure can be effectively reduced. The result scanned by the attacker using the port scanning tool is no longer two SSH services, but instead an irrelevant service port or an unresponsive empty port, thereby misleading the attacker into thinking that the SSH honeypot does not exist, thereby improving the concealment of the honeypot and the ability to capture the attacker's attack behavior.

[0039] In some embodiments, the process of executing step S2 includes:

[0040] S2.1, judging whether it is a malicious user based on the number of failed login requests from the same IP in a set time window;

[0041] S2.2. Forward traffic or provide real SSH service.

[0042] Specifically, when executing step S2.1, judging whether the user is a malicious user based on the number of failed login requests from the same IP address in a set time window includes:

[0043] When a user logs in to the SSH service, the number of failed login requests from the same IP is detected based on a set time window. When the number of failed login requests from the same IP exceeds a maximum threshold, the user is determined to be a malicious user.

[0044] Furthermore, when detecting the number of failed login requests from the same IP based on a set time window, the following formula is used:

[0045]

[0046] Here, n(T) refers to the number of failed logins from the same IP within the time window T, and m is the total number of logins from the same IP within T.

[0047] Furthermore, the time window limit is set to 0.3 seconds, and the maximum threshold of the number of failed login requests from the same IP address is 5 times.

[0048] In fact, it takes a certain amount of time for a normal user to manually enter a password when logging in through SSH, and it takes a certain amount of time for the user to think each time the password is wrong. At the same time, the SSH server will introduce a certain amount of time delay in processing each password verification in the same login request to slow down potential brute force attacks. When an attacker uses SSH brute force software to carry out SSH brute force attacks, he can use multi-threading and parallel methods to make dozens of login attempts in a very short period of time, which is far faster than the operation speed of a normal user. In addition, the attacker uses a brute force dictionary to exhaustively brute force the password, which also increases a large number of failed attempts. Therefore, the number of failed login requests from the same IP in the set time window can effectively determine whether it is a malicious user.

[0049] Specifically, when executing step S2.2 to forward traffic or provide real SSH services, it includes:

[0050] When a malicious user is identified, the traffic of the IP is forwarded to the SSH honeypot based on the iptables PREROUTING rule, and the attack information is captured based on the SSH honeypot;

[0051] When a user is identified as a normal user, the traffic of the user's IP address is connected to the real SSH service.

[0052] Furthermore, the process of executing the iptables-based PREROUTING rule to forward the traffic of the IP to the SSH honeypot includes: adding the malicious user IP to the nat table of iptables, and forwarding the traffic belonging to the malicious user IP to the port where the SSH honeypot service is located.

[0053] In fact, through traffic forwarding, all user login ports are set to the default SSH service port, but the traffic direction is dynamically determined according to the user's behavior pattern. The IP traffic of malicious attackers will be forwarded to the SSH honeypot service, while normal users will not be forwarded and connected to the real SSH service. This not only does not interfere with the user experience of normal users, but also improves the concealment of the honeypot to a certain extent.

[0054] In some other embodiments, during the execution of step S1, see Figure 2 ,include:

[0055] The attacker performs a port scan and finds the honeypot port. The attacker redirects the traffic that attempts to directly enter the honeypot port and uses a firewall to redirect the traffic to an empty port or other service port, so that the scan result shows no service or other service, thereby hiding the SSH honeypot service.

[0056] In some other embodiments, during the execution of step S2, see Figure 3,include:

[0057] The user logs in to SSH, sets a time window T, records the number of login failures, and determines whether the number of consecutive failures n within the time window T exceeds the threshold N. When it does not exceed the threshold N, it is determined to be normal user traffic, and the traffic is not forwarded, and the SSH service is accessed normally. When it exceeds the threshold N, it is determined to be brute force SSH traffic, and iptables is used for traffic forwarding to import malicious traffic into the SSH honeypot to complete traffic forwarding.

[0058] The embodiment of the present invention provides an SSH honeypot deployment system based on traffic transfer, including a traffic redirection module and a traffic transfer module, wherein:

[0059] Traffic redirection module: When a malicious user performs a port scan, the traffic directly accessing the SSH honeypot is redirected to an empty port or a non-SSH service port based on firewall technology, so that only one SSH service is obtained by the scan;

[0060] Traffic transfer module: When a user logs in to the SSH service, it determines whether the user is a malicious user based on the number of failed login requests from the same IP in the set time window. If the user is determined to be a malicious user, the traffic of the IP will be forwarded to the SSH honeypot, and the attack information will be captured based on the SSH honeypot. Otherwise, real SSH service will be provided.

[0061] An embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores an executable program; when the executable program is executed, the payment method based on visible light communication as described above is implemented.

[0062] Although the embodiments of the present invention are described in detail above, it is obvious to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as described in the claims. Moreover, the present invention described herein may have other embodiments and may be implemented or realized in a variety of ways.

Claims

1. A method for deploying SSH honeypot based on traffic transfer, characterized in that: The following steps are involved: When an attacker performs a port scan, the firewall technology redirects the traffic directly accessing the SSH honeypot to an empty port or a non-SSH service port, so that only one SSH service port is obtained through the scan. When a user logs in to the SSH service, it is determined whether the user is a malicious user based on the number of failed login requests from the same IP in a set time window. If the user is determined to be a malicious user, the traffic of the IP is forwarded to the SSH honeypot, and the attack information is captured based on the SSH honeypot. Otherwise, real SSH service is provided.

2. According to the method for deploying SSH honeypot based on traffic transfer in claim 1, it is characterized in that: The SSH honeypot is deployed on a different port from the SSH service.

3. The SSH honeypot deployment method based on traffic transfer according to claim 1 is characterized in that: The process of redirecting the traffic directly accessing the SSH honeypot to an empty port or a non-SSH service port based on firewall technology includes: The traffic that attempts to directly access the SSH honeypot is redirected to an empty port or a non-SSH service port based on firewall technology, making the SSH honeypot appear as an unresponsive empty port or a service port unrelated to SSH.

4. The SSH honeypot deployment method based on traffic transfer according to claim 1 is characterized in that: The process of judging whether the user is malicious based on the number of failed login requests from the same IP address in a set time window includes: The number of failed login requests from the same IP is detected based on a set time window. When the number of failed login requests from the same IP exceeds a maximum threshold, the user is determined to be a malicious user.

5. The SSH honeypot deployment method based on traffic transfer according to claim 4 is characterized in that: When detecting the number of failed login requests from the same IP address based on a set time window, the following formula is used: Here, n(T) refers to the number of failed logins from the same IP within the time window T, and m is the total number of logins from the same IP within T.

6. The SSH honeypot deployment method based on traffic transfer according to claim 4 is characterized in that: The set time window limit is 0.3 seconds, and the maximum threshold for failed login requests from the same IP address is 5 times.

7. The SSH honeypot deployment method based on traffic transfer according to claim 1 is characterized in that: When a malicious user is identified, the process of forwarding the traffic of the IP to the SSH honeypot includes: When a user is determined to be a malicious user, the traffic of the IP address is forwarded to the SSH honeypot based on the PREROUTING rule of iptables.

8. The SSH honeypot deployment method based on traffic transfer according to claim 7 is characterized in that: The process of executing the iptables-based PREROUTING rule to forward the traffic of the IP to the SSH honeypot includes: adding the malicious user IP to the nat table of iptables, and forwarding the traffic belonging to the malicious user IP to the port where the SSH honeypot service is located.

9. An SSH honeypot deployment system based on traffic transfer, characterized in that: It includes traffic redirection module and traffic transfer module, among which: Traffic redirection module: When an attacker performs a port scan, the traffic directly accessing the SSH honeypot is redirected to an empty port or a non-SSH service port based on firewall technology, so that only one SSH service is obtained through the scan; Traffic transfer module: When a user logs in to the SSH service, it determines whether the user is a malicious user based on the number of failed login requests from the same IP in the set time window. If the user is determined to be a malicious user, the traffic of the IP will be forwarded to the SSH honeypot, and the attack information will be captured based on the SSH honeypot. Otherwise, real SSH service will be provided.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed, the method according to any one of claims 1 to 8 is performed.

Images