Multi-mode deception defense system design method
By designing a multimodal spoofing defense system, simulation and trapping of multimodal security objects is solved, and traditional technology cannot meet the multimodal feature requirements for data security, achieving efficient network security and data security trapping capabilities.
Patent Information
- Application Number
- CN202411878455.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-19
- Publication Date
- 2025-03-21
AI Technical Summary
Traditional deception defense technology mainly uses high-interaction sandbox detection, which cannot meet the multi-modal characteristics of data security objects brought about by digital development. The honeynet is too small in scale and has weak trapping capabilities, so it cannot adapt to the rapid expansion of network shape.
A multimodal spoofing defense system is designed to target multimodal security objects. Simulation and trapping methods are designed for each type of security object to realize a multimodal simulation component collection. Based on the multimodal characteristics, simulation network construction methods and trapping strategies are designed to form a closed loop of detection, analysis and response.
It effectively improves the comprehensive trapping capabilities for network security, data security, and vulnerabilities, conducts in-depth trapping of highly concealed unknown network attacks, improves the awareness and control of unknown attacks, and improves the trapping capabilities, scenario adaptability, and linkage capabilities with security products of honeypots.
Smart Images
Figure CN119675968A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of network security technology, and in particular to a multi-modal deception defense system design method. Background Art
[0002] Deception defense (commonly known as honeypot) technology has made great progress in recent years. It is an emerging network security defense tactic based on the idea of attack and defense confrontation, allowing defenders to observe the behavior of attackers. In particular, as attack and defense drills are carried out regularly in various industries, honeypot products are widely used to build a deception defense system in attack and defense confrontation, realize active defense against attacks, and enable defenders to achieve good results in attack and defense drills.
[0003] Honeypot technology is essentially a deception defense technology. By placing some hosts, network services or information as bait, it can induce attackers to access and attack them. In this way, the attack behavior can be captured and analyzed, the tools and methods used by the attackers can be understood, and the attack intentions and technical means can be identified, thereby achieving security protection through technical and management means.
[0004] In recent years, the development of network security technology has been based on the continuous expansion of the scope of security objects. Traditional network security objects are IP-based hosts and IP-based network segments. With the advent of the digital era, the focus of security concerns has gradually deepened to the data security level. Data security objects include operating systems, application software, application services, communication links, protocols, ports, databases, database data tables, fields, various types of files, APIs, identities, vulnerabilities, etc. It can be seen that data security objects have obvious multimodal characteristics. Modality here refers to the above-mentioned attribute interface of data security; multimodality refers to the various forms of data security detection and defense. At present, the types and attributes of security objects vary greatly, and the multimodal characteristics make it difficult for traditional security detection, analysis, and defense methods to adapt.
[0005] Traditional deception defense technology mainly focuses on highly interactive sandbox detection, and its security targets are hosts and containers. The security targets are single, and it cannot meet the data security needs brought about by digital development, nor can it form collaborative security detection, analysis, and defense capabilities with current data security products. The main problems of traditional honeypot products are as follows:
[0006] 1. It mainly relies on highly interactive sandbox detection, and its security targets are hosts and containers. The security objects are single and cannot meet the multimodal feature requirements of data security objects brought about by digital development.
[0007] 2. Since high-interaction sandboxes require very high hardware resources, the scale of the honeynet is too small and the trapping ability is weak, which cannot meet the requirements of the rapid expansion and dimensionality of network forms brought about by the trend of the Internet of Everything in the digital age.
[0008] 3. Use a high-interaction sandbox to output attack behavior characteristics, but for specific security objects, further special intelligence processing is required. Currently, it is difficult to form collaborative security detection, analysis, and defense capabilities with data security products. Summary of the invention
[0009] The present invention provides a multimodal deception defense system design method. For multimodal security objects, simulation and trapping methods are designed for each type of security object (single-mode object) to realize a multimodal simulation component set. Based on the multimodal characteristics, a simulation network construction method and a trapping strategy construction method are designed to realize a closed loop of detection, analysis, and response, thereby realizing a multimodal network security and data security trapping system for the digital age.
[0010] The present invention provides a multi-modal deception defense system design method, comprising:
[0011] Design simulation objects, including personnel, hosts, applications, vulnerabilities, databases, and files;
[0012] Design a simulation entity template composition for simulation object generation as a simulation component set, the simulation component set itself does not have network parameters and business parameters, is dynamically generated in the multimodal trapping engine when applied, and is applied after setting parameters;
[0013] Design the multimodal trapping engine, including an attack identification module, an attack modeling engine, an attack knowledge graph, a multimodal trapping network generator, a multimodal simulation module, a multimodal data acquisition module, a multimodal trapping detection engine, and a response strategy generator;
[0014] Design a multi-modal entrapment security center that implements entrapment management functions, including attack process tracing, attack payload extraction, response linkage, event retrieval, and risk reporting;
[0015] Design multi-modal entrapment connection subsystem, including security detection equipment, security defense equipment, and customer business network;
[0016] The simulation object, simulation component set, multimodal trapping engine, multimodal trapping security center, and multimodal trapping connection subsystem are combined to form the multimodal deception defense system; wherein the multimodal trapping engine is respectively connected to the simulation component set, multimodal trapping security center, security detection equipment, security defense equipment, and customer business network, and the simulation component set is connected to the simulation object.
[0017] Furthermore, the simulation component set includes a host component, a container component, an identity component, an API component, a database component, a file component, a data flow component, a vulnerability component, and an encryption unit; wherein,
[0018] Host component: A host simulation method, designed as a host in a running state, including an operating system, for loading application software, API components, identity components, database components, file components, data flow components, file components, vulnerability components, forming an interactive environment, interface, and data flow;
[0019] Container component: A simulation method of a container, designed as a container in a running state, including an operating system, which can load application software, API components, identity components, database components, file components, data flow components, file components, and vulnerability components to form an interactive environment, interface, and data flow;
[0020] Identity component: an identity simulation method designed to simulate the account and password information of the host, application, and database. The identity component can manage, distribute, and modify the identities of other simulated components in the system, and automatically and dynamically generate weak passwords;
[0021] API component: API simulation method, designed as an operational API port, used to load identity components and vulnerability components to achieve data interaction and access;
[0022] Database component: The database simulation method is designed to build simulation database forms, simulation database data fields, data content, loadable identity components, data flow components, and vulnerability components according to the database type;
[0023] File component: The simulation method of files is designed to construct simulation files according to file types, and to distribute simulation files in a decentralized manner according to the storage distribution characteristics of real business files in the network;
[0024] Data flow component: data flow simulation method, management of various types of simulated data flows, setting of various application, protocol, port, database type attributes, automatic identification and generation of data content based on existing network traffic;
[0025] Vulnerability component: a vulnerability simulation method designed to build a vulnerability environment according to the vulnerability type. The implementation method includes building a vulnerability version method based on the system, software, application, and middleware objects, as well as an access interaction method;
[0026] Encryption unit: designed as a manageable encryption tool unit to encrypt database data, data streams, and files.
[0027] Furthermore, the vulnerability types include SQL injection vulnerabilities, cross-site scripting vulnerabilities, weak password vulnerabilities, HTTP header tracking vulnerabilities, Struts2 remote command execution vulnerabilities, framework phishing vulnerabilities, file upload vulnerabilities, application test script leakage, and sensitive information leakage vulnerabilities.
[0028] Furthermore, the vulnerability component includes two forms:
[0029] (a) Specific versions of systems, software, applications, or middleware that contain multiple types of vulnerabilities;
[0030] (b) An access interaction unit constructed based on vulnerability exploitation attack access and response packet information using an access interaction method.
[0031] Furthermore, in the multimodal trapping engine,
[0032] The multimodal trapping network generator is respectively connected to the attack modeling engine, the multimodal simulation module, the multimodal trapping detection engine, and the multimodal data acquisition module;
[0033] The attack modeling engine is also connected to the attack identification module and the attack knowledge graph, and the attack identification module is also connected to the security detection device;
[0034] The multimodal simulation module is also connected to the simulation component, and the simulation component is a component unit in the simulation component set;
[0035] The multimodal trapping detection engine is also connected to the response strategy generator, and the response strategy generator is also connected to the security defense device;
[0036] The multimodal data acquisition module is also connected to the customer service network.
[0037] Furthermore, in the multimodal trapping engine,
[0038] Attack identification module: reads the attack event information and threat intelligence data of security detection equipment in real time, normalizes the data, extracts attack feature information, and sends the attack feature information to the attack modeling engine;
[0039] Attack modeling engine: after receiving the attack feature information, it retrieves the attack knowledge graph, constructs the attack event into an attack model containing multimodal attack feature parameters, and sends it to the multimodal trapping network generator;
[0040] Attack knowledge graph: Contains a set of attack process models built according to APT attacks, including multimodal information data of five-tuples, accounts, files, databases, middleware, access session features, vulnerability exploits, and multimodal data relationship vector graphs involved in the attack process;
[0041] How the Multimodal Decoy Network Generator works:
[0042] (1) receiving a service network model including multimodal parameters;
[0043] (2) receiving an attack model including multi-modal parameters;
[0044] (3) Perform matrix calculation on the business network model and the attack model to generate a dynamic multimodal node construction model and parameters, and send them to the multimodal simulation module;
[0045] (4) The multimodal trapping network generator receives the multimodal simulation network data model sent by the multimodal simulation module, creates and distributes multimodal node entities according to the model, and completes the creation of the multimodal trapping system;
[0046] Multimodal simulation module: receives the multimodal node construction model and parameters sent by the multimodal trapping network generator, retrieves the simulation component model, configures the parameters, generates a multimodal simulation network data model, and sends it to the multimodal trapping network generator;
[0047] Multimodal data collection module: extracts multimodal data from the business network through network active scanning, host active scanning, traffic passive discovery, traffic file restoration, and penetration testing functions, draws a business network model containing multimodal parameters, and sends it to the multimodal trapping network generator;
[0048] Multimodal trapping detection engine: records the information captured by the multimodal trapping node, reconstructs the source of the APT attack based on the attack model, restores the APT attack event process, and sends the APT attack event to the response strategy generator:
[0049] Response strategy generator: Generates multi-modal parameter response strategies based on the characteristics of APT attack events and sends them to corresponding security defense devices.
[0050] Furthermore, the multimodal trapping engine implements three types of trapping capabilities:
[0051] 1) Network security trapping capabilities: including host trapping, container trapping, container trapping, application service trapping, session access trapping, and middleware trapping;
[0052] 2) Data security trapping capabilities: including database trapping, data file trapping, API trapping, account trapping, and credential trapping;
[0053] 3) Vulnerability trapping: including system vulnerability trapping, software vulnerability trapping, input verification vulnerability trapping, access control vulnerability trapping, and remote execution vulnerability trapping.
[0054] Furthermore, in the multi-modal trapping connection subsystem,
[0055] Security detection equipment: an external system connected to the deception engine, which sends attack events and threat intelligence data to the deception engine for analysis and application;
[0056] Security defense device: An external system connected to the trap engine that performs attack blocking operations according to the received response strategy:
[0057] Business network: The external system connected to the deception engine is the protection target of the multimodal deception defense system.
[0058] The beneficial effects of the present invention are:
[0059] The present invention constructs a practical, safe and reliable deception defense system to achieve multi-modal simulation and trapping of complex business systems. It can effectively improve the comprehensive trapping capabilities for network security, data security, and vulnerabilities, deeply trap highly concealed unknown network attacks, and further improve the cognition and control of unknown attacks. The use of a multi-modal method to build a honeypot greatly improves the trapping ability, scene adaptability, and linkage ability with security products, especially data security products, effectively improves the trapping ability and trapping efficiency, thereby greatly improving the economic benefits of technology applications. BRIEF DESCRIPTION OF THE DRAWINGS
[0060] Figure 1 It is a schematic diagram of the structure of the multimodal deception defense system in the present invention.
[0061] Figure 2 It is a schematic diagram of the structure of the multimodal trapping engine in the present invention.
[0062] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION
[0063] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.
[0064] The present invention adopts multimodal trapping technology, and studies various types of simulation and trapping technologies for multimodal security objects, and integrates them to achieve multimodal trapping, which can achieve fine-grained precision and directional trapping, and form synergy with data security technology capabilities to build a new data security capability system. At the same time, multimodal trapping technology can also achieve directional trapping in a specific field based on single-mode characteristics, such as API security directional trapping, vulnerability exploit directional trapping, etc., which can achieve lightweight deployment and application. Compared with traditional honeypots, it can be more flexibly adapted to special data security scenarios, and cooperate with data security products and technologies to form special defense capabilities.
[0065] The present invention designs a multimodal deception defense system, which is oriented to multimodal security objects. Simulation and trapping methods are designed for each type of security object (single-mode object) to implement a multimodal simulation component set. Based on the multimodal characteristics, a simulation network construction method and a trapping strategy construction method are designed to achieve a closed loop of detection, analysis, and response, thereby realizing a multimodal network security and data security trapping system for the digital age.
[0066] The present invention provides a multi-modal deception defense system design method, comprising:
[0067] S1. Design simulation objects, including personnel, hosts, applications, vulnerabilities, databases, and files;
[0068] S2. Design a simulation entity template composition for simulation object generation as a simulation component set. The simulation component set itself does not have network parameters and business parameters. When applied, it is dynamically generated in the multimodal trapping engine and applied after setting parameters.
[0069] S3, designing the multimodal trapping engine, including an attack identification module, an attack modeling engine, an attack knowledge graph, a multimodal trapping network generator, a multimodal simulation module, a multimodal data acquisition module, a multimodal trapping detection engine, and a response strategy generator;
[0070] S4. Design a multimodal trapping security center that implements trapping management functions, including attack process tracing, attack payload extraction, response linkage, event retrieval, and risk reporting;
[0071] S5. Design a multi-modal trapping connection subsystem, including security detection equipment, security defense equipment, and customer business network;
[0072] S6. Combine the simulation object, simulation component set, multimodal trapping engine, multimodal trapping security center, and multimodal trapping connection subsystem to form the multimodal deception defense system; wherein the multimodal trapping engine is respectively connected to the simulation component set, multimodal trapping security center, security detection equipment, security defense equipment, and customer business network, and the simulation component set is connected to the simulation object.
[0073] That is, Figure 1 As shown, the multimodal deception defense system includes: (1) simulation object design; (2) multimodal deception defense system simulation component design; (3) multimodal trapping engine design; (4) multimodal trapping security center design; (5) multimodal trapping connection subsystem design.
[0074] (1) Multimodal deception defense system simulation object:
[0075] Includes the following: personnel, hosts, applications, vulnerabilities, databases, and files.
[0076] (2) Design of simulation components for multimodal deception defense system:
[0077] The simulation component set is composed of simulation entity templates generated for simulation objects. The simulation component itself does not carry network parameters and business parameters. When applied, it needs to be dynamically generated in the multimodal trapping system and applied after setting parameters, including the following:
[0078] 1) Host component: The host simulation method is designed as a host sandbox with high interactive characteristics, and the host is designed as a running state, including an operating system, which can load application software, API components, identity components, database components, file components, data flow components, file components, and vulnerability components to form an interactive environment, interface, and data flow;
[0079] 2) Container component: The simulation method of the container is designed as a container unit with high interactive characteristics, and is designed as a container in a running state, including an operating system, which can load application software, API components, identity components, database components, file components, data flow components, file components, and vulnerability components to form an interactive environment, interface, and data flow;
[0080] 3) Identity component: The identity simulation method is designed to simulate the account and password information based on the host, application, database, etc. The identity component can manage, distribute, and modify the identities of other simulated components in the system, and support automatic dynamic generation of weak passwords;
[0081] 4) API component: API simulation method, designed as an operational API port, which can load identity components and vulnerability components, and realize data interaction and access;
[0082] 5) Database components: The database simulation method is designed to build simulation database forms, simulation database data fields, data content, loadable identity components, data flow components, and vulnerability components according to the database type;
[0083] 6) File component: The simulation method of the file is designed to construct the simulation file according to the file type, and distribute the simulation file in a decentralized manner according to the storage distribution characteristics of the real business files in the network;
[0084] 7) Data flow component: data flow simulation method, which can manage various types of simulated data flows, support the setting of various applications, protocols, ports, and database type attributes, and automatically identify and generate data content based on existing network traffic;
[0085] 8) Vulnerability component: The vulnerability simulation method is designed to build a vulnerability environment according to the vulnerability type, including SQL injection vulnerabilities, cross-site scripting vulnerabilities, weak password vulnerabilities, HTTP header tracking vulnerabilities, Struts2 remote command execution vulnerabilities, framework phishing vulnerabilities, file upload vulnerabilities, application test script leakage, sensitive information leakage vulnerabilities, etc. The implementation methods include building vulnerability version methods based on system, software, application, middleware and other objects, as well as access interaction methods, etc.
[0086] The vulnerability component contains two forms:
[0087] a. Specific versions of systems, software, applications, middleware, etc. that contain multiple types of vulnerabilities.
[0088] b. An access interaction unit constructed based on vulnerability exploitation attack access and response packet information using an access interaction method.
[0089] 9) Encryption unit: designed as a manageable encryption tool unit that can encrypt database data, data streams, and files.
[0090] (3) Multimodal trapping engine design, such as Figure 2 As shown, it includes 9 component units:
[0091] 01: Attack Identification Module
[0092] The attack identification module reads the attack event information and threat intelligence data of the security detection equipment in real time, normalizes the data, extracts the attack feature information, and sends the attack feature information to the attack modeling engine.
[0093] 02: Attack Modeling Engine
[0094] After receiving the attack feature information, the attack modeling engine retrieves the attack knowledge graph, constructs the attack event into an attack model containing multimodal attack feature parameters, and sends it to the multimodal trapping network generator;
[0095] 03: Attacking the Knowledge Graph
[0096] The attack knowledge graph unit contains a set of attack process models built according to APT attacks, including multimodal information data such as quintuples, accounts, files, databases, middleware, access session features, vulnerability exploits, and multimodal data relationship vector graphs involved in the attack process.
[0097] 04: Multimodal Decoy Network Generator
[0098] Working principle of multi-modal trapping network generator:
[0099] 1> receiving a business network model including multimodal parameters;
[0100] 2> Receive an attack model containing multimodal parameters;
[0101] 3> Perform matrix calculation on the business network model and attack model to generate a dynamic multimodal node construction model and parameters, and send them to the multimodal simulation module;
[0102] 4> The multimodal trapping network generator receives the multimodal simulation network data model sent by the multimodal simulation module, creates and distributes multimodal node entities according to the model, and completes the creation of the multimodal trapping system;
[0103] 05: Multimodal simulation module
[0104] The multimodal simulation module receives the multimodal node construction model and parameters sent by the multimodal trapping network generator, retrieves the simulation component model, performs parameter configuration, generates a multimodal simulation network data model, and sends it to the multimodal trapping network generator;
[0105] 06: Multimodal data acquisition module
[0106] The multimodal data collection module supports the extraction of multimodal data in the business network through active network scanning, active host scanning, passive traffic discovery, traffic file restoration, and penetration testing functions, and draws a business network model containing multimodal parameters and sends it to the multimodal trapping network generator;
[0107] 07: Multimodal deception detection engine
[0108] The multimodal trapping detection engine records the information captured by the multimodal trapping nodes, reconstructs the source of the APT attack based on the attack model (multimodal parameters), restores the APT attack event process, and sends the APT attack event (including multimodal parameters) to the response strategy generator.
[0109] 08: Response Strategy Generator
[0110] The response strategy generator generates a multi-modal parameter response strategy based on the characteristics of the APT attack event (including multi-modal parameters) and sends it to the corresponding security defense device.
[0111] 09: Simulation Components
[0112] The simulation component is a component unit in the simulation component set of the multimodal deception defense system.
[0113] The multi-modal trapping engine implements three types of trapping capabilities:
[0114] 1) Network security trapping capabilities: including host trapping, container trapping, container trapping, application service trapping, session access trapping, middleware trapping, etc.;
[0115] 2) Data security trapping capabilities: including database trapping, data file trapping, API trapping, account trapping, credential trapping, etc.;
[0116] 3) Vulnerability trapping: including system vulnerability trapping, software vulnerability trapping, input verification vulnerability trapping, access control vulnerability trapping, remote execution vulnerability trapping, etc.
[0117] (4) Multi-modal trapping security center design:
[0118] The security center includes functions such as attack process tracing, attack payload extraction, response linkage, event retrieval, and risk reporting to realize the management function of entrapment.
[0119] (5) Multimodal trapping connection subsystem design:
[0120] Including security detection equipment, security defense equipment, and customer business network.
[0121] 1> Security detection equipment: Security detection equipment is an external system connected to the trap engine, which supports sending attack events, threat intelligence and other data to the trap engine for analysis and application.
[0122] 2> Security defense equipment: The security detection equipment is an external system connected to the trapping engine, which supports attack blocking operations according to the received response strategy.
[0123] 3> Business network: The business network is an external system connected to the deception engine and is the protection target of the multimodal deception defense system.
[0124] The present invention constructs a practical, safe and reliable deception defense system to achieve multi-modal simulation and trapping of complex business systems. It can effectively improve the comprehensive trapping capabilities for network security, data security, and vulnerabilities, deeply trap highly concealed unknown network attacks, and further improve the cognition and control of unknown attacks. The use of a multi-modal method to build a honeypot greatly improves the trapping ability, scene adaptability, and linkage ability with security products, especially data security products, effectively improves the trapping ability and trapping efficiency, thereby greatly improving the economic benefits of technology applications.
[0125] Specific examples:
[0126] When the customer network node scale is calculated based on 10,000 points, the mirror traffic of the network core interaction is generally 5Gbps. Taking a server (CPU16 cores, memory 128G) as an example, the traditional honeypot trapping network is generally 5-10 high-interaction sandboxes. The multimodal trapping system can achieve 3-5 high-interaction sandboxes, 10+ application service trapping / session access units, 10+ database trapping units, 200+ file trapping units, 10+ API trapping units, 50+ credential / account trapping units, and 100+ vulnerability trapping units. Both the breadth and depth of trapping have been greatly improved, and the actual attack event capture rate is >90%. When linked with security equipment (especially data security equipment), the security operation efficiency is improved by more than 50%.
[0127] Working example of the multimodal deception defense system, using ransomware as an example:
[0128] 001: Multimodal data acquisition module performs data acquisition:
[0129] The multimodal data collection module extracts multimodal data from the business network through network active scanning, host active scanning, traffic passive discovery, traffic file restoration, and penetration testing functions, and draws a business network model containing multimodal parameters, including: network topology (multi-layer network IP information), network protocol, asset equipment information, asset system information, application information, traffic information, host account information, personnel account information, database information, database account information, database table information, vulnerability information, file type information, file distribution information, etc.
[0130] The multimodal data acquisition module supports interactive operations and manual maintenance of the above information; the multimodal data acquisition module supports the AI unit to perform large model verification on the above information;
[0131] The multimodal data acquisition module generates a business network model containing multimodal parameters from the processed information and sends it to the multimodal trapping network generator;
[0132] 002: The attack identification module receives a ransomware attack event. The attack identification module identifies the ransomware type, feature information, attack source, target asset, and session protocol of the attack event and sends them to the attack modeling engine.
[0133] 003: After receiving the ransomware attack information, the attack modeling engine retrieves the attack knowledge graph, constructs the attack event into an attack model containing attack feature parameters such as the network scope, asset type, protocol type, session mode, vulnerability exploitation mode, database target, file target, etc., and sends it to the multimodal trapping network generator;
[0134] 004: After receiving the information in 001 and 003, the multimodal trapping network generator performs matrix calculation based on the information to generate a dynamic multimodal node construction model and parameters, including file component, host component, identity component, database component, vulnerability component node information and parameters; and sends it to the multimodal simulation module;
[0135] 005: The multimodal simulation module generates a multimodal simulation network data model according to the received information and sends it to the multimodal trapping network generator;
[0136] 006: The multi-modal entrapment network generator generates a simulated entrapment network. The simulated entrapment network includes host entrapment, database entrapment, file entrapment, identity entrapment, and vulnerability entrapment capabilities built for ransomware. When the ransomware attempts to:
[0137] (1) Ransomware performs lateral scanning on the intranet and can be lured by the host;
[0138] (2) When ransomware escalates privileges in the intranet, it can be trapped by identity;
[0139] (3) When ransomware encrypts databases and files on the intranet, it can be trapped by databases and files;
[0140] (4) When ransomware exploits vulnerabilities in the intranet to attack other systems, it can be lured by the vulnerability;
[0141] Therefore, through multimodal construction, the trapping capability is greatly improved.
[0142] 007: When the multimodal trapping detection engine detects the detection alarm of the above trapping unit, it traces and reconstructs the APT attack according to the ransomware attack model, restores the APT attack event process, and sends the ransomware attack event and the contained host access information, database access information, encryption information, file encryption information, identity exploitation information, and vulnerability exploitation information to the response strategy generator.
[0143] 008: The response strategy generator generates a response strategy based on the above information, sends the host access to the firewall for blocking and generates threat intelligence, adds the attack source to the blacklist, sends the identity utilization information to the identity management system, cancels all identity information of the attack source, sends the vulnerability utilization information to the host management system, performs baseline control, etc.
[0144] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, device, article or method including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, device, article or method. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the presence of other identical elements in the process, device, article or method including the element.
[0145] The above description is only a preferred embodiment of the present invention, and does not limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made by using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.
Claims
1. A multi-modal deception defense system design method, characterized in that: include: Design simulation objects, including personnel, hosts, applications, vulnerabilities, databases, and files; Design a simulation entity template composition for simulation object generation as a simulation component set, the simulation component set itself does not have network parameters and business parameters, is dynamically generated in the multimodal trapping engine when applied, and is applied after setting parameters; Design the multimodal trapping engine, including an attack identification module, an attack modeling engine, an attack knowledge graph, a multimodal trapping network generator, a multimodal simulation module, a multimodal data acquisition module, a multimodal trapping detection engine, and a response strategy generator; Design a multi-modal entrapment security center that implements entrapment management functions, including attack process tracing, attack payload extraction, response linkage, event retrieval, and risk reporting; Design multi-modal entrapment connection subsystem, including security detection equipment, security defense equipment, and customer business network; The simulation object, simulation component set, multimodal trapping engine, multimodal trapping security center, and multimodal trapping connection subsystem are combined to form the multimodal deception defense system; wherein the multimodal trapping engine is respectively connected to the simulation component set, multimodal trapping security center, security detection equipment, security defense equipment, and customer business network, and the simulation component set is connected to the simulation object.
2. The multi-modal deception defense system design method according to claim 1, characterized in that: The simulation component set includes a host component, a container component, an identity component, an API component, a database component, a file component, a data flow component, a vulnerability component, and an encryption unit; wherein, Host component: A host simulation method, designed as a host in a running state, including an operating system, for loading application software, API components, identity components, database components, file components, data flow components, file components, vulnerability components, forming an interactive environment, interface, and data flow; Container component: A simulation method of a container, designed as a container in a running state, including an operating system, which can load application software, API components, identity components, database components, file components, data flow components, file components, and vulnerability components to form an interactive environment, interface, and data flow; Identity component: an identity simulation method designed to simulate the account and password information of the host, application, and database. The identity component can manage, distribute, and modify the identities of other simulated components in the system, and automatically and dynamically generate weak passwords; API component: API simulation method, designed as an operational API port, used to load identity components and vulnerability components to achieve data interaction and access; Database component: The database simulation method is designed to build simulation database forms, simulation database data fields, data content, loadable identity components, data flow components, and vulnerability components according to the database type; File component: The simulation method of files is designed to construct simulation files according to file types, and to distribute simulation files in a decentralized manner according to the storage distribution characteristics of real business files in the network; Data flow component: data flow simulation method, management of various types of simulated data flows, setting of various application, protocol, port, database type attributes, automatic identification and generation of data content based on existing network traffic; Vulnerability component: a vulnerability simulation method designed to build a vulnerability environment according to the vulnerability type. The implementation method includes building a vulnerability version method based on the system, software, application, and middleware objects, as well as an access interaction method; Encryption unit: designed as a manageable encryption tool unit to encrypt database data, data streams, and files.
3. The multi-modal deception defense system design method according to claim 2, characterized in that: The vulnerability types include SQL injection vulnerabilities, cross-site scripting vulnerabilities, weak password vulnerabilities, HTTP header tracking vulnerabilities, Struts2 remote command execution vulnerabilities, framework phishing vulnerabilities, file upload vulnerabilities, application test script leakage, and sensitive information leakage vulnerabilities.
4. The multi-modal deception defense system design method according to claim 2, characterized in that: The vulnerability component contains two forms: (a) Specific versions of systems, software, applications, or middleware that contain multiple types of vulnerabilities; (b) An access interaction unit constructed based on vulnerability exploitation attack access and response packet information using an access interaction method.
5. The multi-modal deception defense system design method according to claim 1, characterized in that: In the multimodal trapping engine, The multimodal trapping network generator is respectively connected to the attack modeling engine, the multimodal simulation module, the multimodal trapping detection engine, and the multimodal data acquisition module; The attack modeling engine is also connected to the attack identification module and the attack knowledge graph, and the attack identification module is also connected to the security detection device; The multimodal simulation module is also connected to the simulation component, and the simulation component is a component unit in the simulation component set; The multimodal trapping detection engine is also connected to the response strategy generator, and the response strategy generator is also connected to the security defense device; The multimodal data acquisition module is also connected to the customer service network.
6. The multi-modal deception defense system design method according to claim 5, characterized in that: In the multimodal trapping engine, Attack identification module: reads the attack event information and threat intelligence data of security detection equipment in real time, normalizes the data, extracts attack feature information, and sends the attack feature information to the attack modeling engine; Attack modeling engine: after receiving the attack feature information, it retrieves the attack knowledge graph, constructs the attack event into an attack model containing multimodal attack feature parameters, and sends it to the multimodal trapping network generator; Attack knowledge graph: Contains a set of attack process models built according to APT attacks, including multimodal information data of five-tuples, accounts, files, databases, middleware, access session features, vulnerability exploits, and multimodal data relationship vector graphs involved in the attack process; How the Multimodal Decoy Network Generator works: (1) receiving a service network model including multimodal parameters; (2) receiving an attack model including multi-modal parameters; (3) Perform matrix calculation on the business network model and the attack model to generate a dynamic multimodal node construction model and parameters, and send them to the multimodal simulation module; (4) The multimodal trapping network generator receives the multimodal simulation network data model sent by the multimodal simulation module, creates and distributes multimodal node entities according to the model, and completes the creation of the multimodal trapping system; Multimodal simulation module: receives the multimodal node construction model and parameters sent by the multimodal trapping network generator, retrieves the simulation component model, configures the parameters, generates a multimodal simulation network data model, and sends it to the multimodal trapping network generator; Multimodal data collection module: extracts multimodal data from the business network through network active scanning, host active scanning, traffic passive discovery, traffic file restoration, and penetration testing functions, draws a business network model containing multimodal parameters, and sends it to the multimodal trapping network generator; Multimodal trapping detection engine: records the information captured by the multimodal trapping node, reconstructs the source of the APT attack based on the attack model, restores the APT attack event process, and sends the APT attack event to the response strategy generator: Response strategy generator: Generates multi-modal parameter response strategies based on the characteristics of APT attack events and sends them to corresponding security defense devices.
7. The multi-modal deception defense system design method according to claim 6, characterized in that: The multimodal trapping engine implements three types of trapping capabilities: 1) Network security trapping capabilities: including host trapping, container trapping, container trapping, application service trapping, session access trapping, and middleware trapping; 2) Data security trapping capabilities: including database trapping, data file trapping, API trapping, account trapping, and credential trapping; 3) Vulnerability trapping: including system vulnerability trapping, software vulnerability trapping, input verification vulnerability trapping, access control vulnerability trapping, and remote execution vulnerability trapping.
8. The multi-modal deception defense system design method according to claim 1, characterized in that: In the multi-modal trapping connection subsystem, Security detection equipment: an external system connected to the deception engine, which sends attack events and threat intelligence data to the deception engine for analysis and application; Security defense device: An external system connected to the trap engine that performs attack blocking operations according to the received response strategy: Business network: The external system connected to the deception engine is the protection target of the multimodal deception defense system.