Trapping capacity monitoring system based on linkage of network security equipment

Abstract

The invention relates to the technical field of network security, in particular to a trapping capacity monitoring system based on network security equipment linkage, which comprises an equipment linkage module, a honeypot trapping module, a suspicious flow guide module, a trapping capacity detection module and a honeypot management module, and is characterized in that the equipment linkage module is used for acquiring suspicious flow data; the suspicious flow guiding module is used for transmitting suspicious flow data to the honeypot trapping module; honeypot instances in the honeypot trapping module are used for obtaining attack behavior characteristics of the suspicious traffic data; the trapping capability detection module is used for evaluating the trapping capability of the honeypot trapping module according to the attack behavior trapping result; and the honeypot management module is used for adjusting honeypot instance deployment in the honeypot trapping module according to an evaluation result of the trapping capability detection module. According to the invention, through linkage cooperation with various network security devices, accurate guidance of suspicious traffic data and efficient capture of attack behaviors are realized, and improvement of security of a target network environment is facilitated.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a trapping capability monitoring system based on the linkage of network security devices. Background Art

[0002] Although traditional network protection devices (such as firewalls) can effectively identify and block some attacks, they still have protection limitations when facing increasingly diverse and hidden attacks. Honeypot technology, as a key supplementary means, simulates the real network environment to attract attackers to expose their attack behaviors, thereby helping security teams obtain attack methods and strategies and improving overall protection capabilities.

[0003] However, traditional honeypot systems are usually deployed in the form of independent hardware devices with limited coverage, making it difficult to conduct extensive and in-depth monitoring of the entire network environment. As the network scale expands, attackers can easily bypass the honeypot and directly attack core resources, and these attacks may not be captured by the honeypot in time, resulting in protection loopholes. In addition, the linkage between traditional honeypot systems and other network security devices (such as firewalls and intrusion detection systems) is poor. Security devices from different manufacturers use their own protocols and instruction sets, lack unified interfaces and collaboration mechanisms, resulting in difficulty in automatically redirecting suspicious traffic to the honeypot for analysis even if a device detects it. Summary of the invention

[0004] The present invention provides a trapping capability monitoring system based on network security device linkage, which aims to achieve accurate guidance of suspicious traffic data and efficient capture of attack behaviors through linkage and cooperation with multiple network security devices, thereby improving the security of the target network environment.

[0005] The trapping capability detection system based on network security device linkage provided by the present invention includes: A device linkage module, each of which is connected to at least one network security device in the target network environment, and is used to obtain suspicious traffic data captured by at least one network security device connected thereto; A honeypot trapping module, the honeypot trapping module includes at least one honeypot instance, the honeypot instance is used to simulate the target network environment, and obtain the attack behavior characteristics of the suspicious traffic data according to the attack behavior of the suspicious traffic data on the simulated network environment; A suspicious traffic guiding module, the suspicious traffic guiding module is connected to the device linkage module and the honeypot trapping module respectively, and the suspicious traffic guiding module is used to transmit the suspicious traffic data obtained by the device linkage module to the honeypot trapping module; A trapping capability detection module, the trapping capability detection module is connected to the honeypot trapping module, and the trapping capability detection module is used to evaluate the trapping capability of the honeypot trapping module according to the attack behavior trapping result of the honeypot trapping module; A honeypot management module, the honeypot management module is connected to the trapping capability detection module and the honeypot trapping module respectively, and the honeypot management module is used to adjust the deployment of honeypot instances in the honeypot trapping module according to the evaluation result of the trapping capability detection module.

[0006] Furthermore, the device linkage module is connected to each network security device in the target network environment through a unique communication channel, each of the communication channels corresponds to a communication protocol, and the communication protocol is used to support data security between the device linkage module and the corresponding network security device.

[0007] Furthermore, each of the honeypot instances receives suspicious traffic data of only one network security device, and each of the suspicious traffic data of the network security device is received by at least one honeypot instance.

[0008] Furthermore, the device linkage module obtains suspicious traffic data captured by at least one network security device connected thereto, comprising the following steps: Respectively obtain the flow data size of each network security device connected to the device linkage module; According to the flow data size of each network security device, a corresponding polling time interval is set. At any polling time node set based on the polling time interval: Sending a first data request to a corresponding network security device, and obtaining log records within a corresponding polling time interval based on the first data request; According to the suspicious traffic data record in the log record, a second data request is sent to the corresponding network security device, and the suspicious traffic data is obtained based on the second data request.

[0009] Furthermore, the suspicious traffic guiding module transmits the suspicious traffic data obtained by the device linkage module to the honeypot trapping module, including the following steps: According to the network security device source of the suspicious traffic data, a guiding path of the suspicious traffic data from the device linkage module to the honeypot trapping module is matched, and the end point of the guiding path is a honeypot instance in the honeypot trapping module corresponding to the network security device source.

[0010] Furthermore, when the number of honeypot instances corresponding to the network security device source in the honeypot trapping module is two or more, the suspicious traffic guiding module transmits the suspicious traffic data obtained by the device linkage module to the honeypot trapping module, and further includes the following steps: According to the load size of each honeypot instance corresponding to the network security device source, an optimal transmission path is screened from the guide path, and the end point of the optimal transmission path is the honeypot instance with the smallest load among the multiple honeypot instances corresponding to the network security device source.

[0011] Furthermore, the trapping capability detection module evaluates the trapping capability of the honeypot trapping module according to the attack behavior trapping result of the honeypot trapping module, including the following steps: The trapping success rate of each honeypot in the honeypot trapping module is obtained respectively, and the trapping success rate is the ratio of the number of effective attacks captured by the honeypot instance to the total number of suspicious traffic data transmitted to the honeypot instance.

[0012] Furthermore, the honeypot management module adjusts the deployment of the honeypot instances in the honeypot trapping module according to the evaluation result of the trapping capability detection module, including the following steps: According to the trapping success rate of each honeypot instance in the honeypot trapping module, the configuration resources of the corresponding honeypot instance are adjusted respectively.

[0013] Furthermore, the trapping capability detection module evaluates the trapping capability of the honeypot trapping module according to the attack behavior trapping result of the honeypot trapping module, and further includes the following steps: The honeypot trapping module response efficiency corresponding to each network security device is obtained respectively, where the honeypot trapping module response efficiency is an average response time of one or more honeypot instances corresponding to the network security device to a group of suspicious traffic data.

[0014] Furthermore, the honeypot management module adjusts the deployment of the honeypot instances in the honeypot trapping module according to the evaluation result of the trapping capability detection module, and further includes the following steps: According to the response efficiency of the honeypot trapping module corresponding to each network security device, the number of honeypot instances corresponding to each network security device is adjusted respectively.

[0015] The trapping capability detection system based on network security device linkage provided by the present invention has the following benefits: The present invention realizes the joint action with multiple network security devices in the target network environment through the device linkage module, breaks through the limitation of single device protection, and expands the coverage of network security management; and through the suspicious traffic guidance module, the suspicious traffic data is intelligently transmitted to the corresponding honeypot instance, so as to realize the accurate capture and analysis of attack behavior; and through the mutual cooperation of the trapping capability detection module and the honeypot management module, a closed-loop optimization feedback mechanism is formed to adjust the deployment and resource allocation of the honeypot instance in real time, so as to ensure that the system always maintains the best trapping effect and efficient resource utilization. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is a structural diagram of a trapping capability detection system based on the linkage of network security devices; Figure 2 A schematic diagram of the linkage between the network security device and the device linkage module provided in an embodiment of the present invention; Figure 3 A schematic diagram of the deployment of a honeypot instance provided in an embodiment of the present invention; Figure 4 The present invention is a flow chart of the entrapment capability detection method based on the linkage of network security devices. DETAILED DESCRIPTION

[0017] The specific embodiments of the present invention will be described in detail below. It should be noted that the embodiments described herein are only for illustration and are not intended to limit the present invention. In the following description, a large number of specific details are set forth in order to provide a thorough understanding of the present invention. However, it is obvious to those of ordinary skill in the art that these specific details do not need to be adopted to implement the present invention. In other examples, in order to avoid confusing the present invention, known circuits, software or methods are not specifically described.

[0018] In one embodiment, see Figure 1 , Figure 1 A schematic diagram of the structure of a trapping capability detection system based on network security device linkage provided by an embodiment of the present invention.

[0019] like Figure 1 As shown, the trapping capability detection system based on network security device linkage provided by the embodiment of the present invention is composed of a device linkage module, a honeypot trapping module, a suspicious traffic guidance module, a trapping capability detection module and a honeypot management module.

[0020] Furthermore, the device linkage module is respectively connected to at least one network security device in the target network environment, and the device linkage module is used to obtain suspicious traffic data captured by at least one network security device connected thereto.

[0021] The target network environment refers to a comprehensive network structure that includes at least one network security device, which can be applicable to network scenarios that require high security protection, such as enterprises, government agencies, or cloud computing environments.

[0022] In this example, see Figure 2 , Figure 2 This is a schematic diagram of the linkage between the network security device and the device linkage module provided by an embodiment of the present invention.

[0023] like Figure 2 As shown, the target network environment includes multiple network security devices such as network security device 1, network security device 2, ..., network security device N-1, network security device N, etc.; further, the network security device 1, the network security device 2, ..., the network security device N-1, the network security device N, etc., are respectively connected to the device linkage module.

[0024] Any network security device is a hardware device or software system used to protect the target network environment from various security threats. It can be any hardware device or software system among hardware firewalls, software firewalls, intrusion prevention systems, security gateways, or other hardware devices or software systems.

[0025] Furthermore, in order to ensure the reliability and compatibility of data transmission between the device linkage module and different network security devices, the device linkage module is connected to each network security device in the target network environment through a unique communication channel, and each of the communication channels corresponds to a communication protocol, which is used to support data transmission between the device linkage module and the corresponding network security device.

[0026] It can be known that the network communication protocol is a collection of rules, standards or conventions established for data exchange in computer networks; further, since different network security devices are suitable for different network communication protocols, an independent communication channel is generated for each network security device, which can then be optimized and configured according to the data transmission requirements of each network security device. For example, more transmission bandwidth can be allocated to high-traffic devices, and a lighter communication method can be configured for low-traffic devices.

[0027] In this embodiment, if Figure 2 As shown, the network security device 1 is connected to the device linkage module via a communication channel L1; the network security device 2 is connected to the device linkage module via a communication channel L2; ...; the network security device N-1 is connected to the device linkage module via a communication channel LN-1; the network security device is connected to the device linkage module via a communication channel LN.

[0028] Furthermore, the suspicious traffic guiding module is connected to the device linkage module and the honeypot trapping module respectively, and the suspicious traffic guiding module is used to transmit the suspicious traffic data obtained by the device linkage module to the honeypot trapping module.

[0029] It should be noted that the suspicious traffic data proposed in the present invention exhibits unusual characteristics or behaviors and may be related to potential security threats, but has not yet been clearly identified as malicious or abnormal network traffic, such as traffic data from unfamiliar IP addresses or network areas without clear business dealings or reasonable reasons for access; traffic data using rare network protocols or non-standard port numbers.

[0030] Generally speaking, when any network security device detects suspicious traffic data, it will block it to prevent it from entering the target network environment.

[0031] In this example, when any network security device detects suspicious traffic data, in addition to blocking it, it also separates it from the rest of the abnormal traffic and transmits it to the device linkage module through the corresponding communication channel, and uses the suspicious traffic guidance module to transmit it to the honeypot trapping module for further analysis.

[0032] Furthermore, the honeypot trapping module includes at least one honeypot instance, and the honeypot instance is used to simulate the target network environment, and obtain the attack behavior characteristics of the suspicious traffic data according to the attack behavior of the suspicious traffic data on the simulated network environment.

[0033] It is understandable that the honeypot trapping module is intended to further optimize network security devices in the target network environment by trapping and collecting attack behaviors of suspicious traffic data.

[0034] For example, to ensure the network environment security of an enterprise network, a honeypot instance simulating a web server is deployed in the honeypot trapping module. After the suspicious traffic data is directed to the simulated web server, the attacker attempts to obtain administrator privileges through brute force login.

[0035] During this process, the honeypot trapping module records the attacker's IP address in detail, as well as scanning, brute force cracking attempts, and attempts to export data in the simulated database after successful login, so that the enterprise network security defense system can update rules and prevent similar attacks in the future.

[0036] Furthermore, in order to isolate the analysis of different suspicious traffic data and improve the pertinence of further analysis of suspicious traffic data, each of the honeypot instances receives suspicious traffic data of a unique network security device, and each of the suspicious traffic data of the network security device is received by at least one honeypot instance.

[0037] In this example, see Figure 3 , Figure 3 A schematic diagram of the deployment of a honeypot instance provided in an embodiment of the present invention; Figure 3 As shown, the suspicious traffic data of the network security device 1 is received by the honeypot instance (1,1); the suspicious traffic data of the network security device 2 is received by the honeypot instance (2,1) and the honeypot instance (2,2); ...; the suspicious traffic data of the network security device N-1 is received by the honeypot instance (N-1,1) honeypot instance (N-1,2) ..., and the honeypot instance (N-1,M); the network security device N is received by the honeypot instance (N,1) honeypot instance (N,2) ..., and the honeypot instance (N,Q); wherein M and Q represent the number of honeypot instances corresponding to the network security device N-1 and the network security device N, respectively.

[0038] Furthermore, the trapping capability detection module is connected to the honeypot trapping module, and the trapping capability detection module is used to evaluate the trapping capability of the honeypot trapping module according to the attack behavior trapping result of the honeypot trapping module.

[0039] It is understandable that the trapping capability of the honeypot trapping module can be characterized by one or more types of evaluation indicators, such as trapping success rate, false alarm rate, attack type coverage, response efficiency, etc.

[0040] In this embodiment, the evaluation index of the trapping capability detection module is intended to optimize the deployment of honeypot instances corresponding to each network security device.

[0041] Specifically, in this embodiment, the trapping success rate is used to evaluate the performance of each honeypot instance. The trapping success rate refers to the ratio of the number of times the honeypot instance successfully captures attack behaviors to the total number of suspicious traffic, and then the configuration of each honeypot instance is adjusted according to its trapping success rate, such as increasing computing resources.

[0042] Specifically, in this embodiment, the response efficiency is also selected to evaluate the overall honeypot instance response of each network security device. The response efficiency is the average response time of one or more honeypot instances corresponding to the network security device to suspicious traffic data, and then according to the overall honeypot instance response of each network security device, the number of honeypot instances corresponding to each network security device is adjusted to ensure the overall response efficiency and resource utilization.

[0043] Furthermore, the honeypot management module is connected to the trapping capability detection module and the honeypot trapping module respectively, and the honeypot management module is used to adjust the honeypot instance deployment in the honeypot trapping module according to the evaluation result of the trapping capability detection module.

[0044] It can be understood that in the trapping capability detection system based on network security device linkage provided by the present invention, the honeypot management module and the trapping capability detection module cooperate with each other to form a closed-loop optimization feedback mechanism to ensure that the honeypot instance can operate effectively in different network security environments.

[0045] In one embodiment, the entrapment capability detection system based on network security device linkage is applicable to a entrapment capability detection method based on network security device linkage, which, combined with the entrapment capability detection system based on network security device linkage, helps to further improve the security of the target network environment.

[0046] See also Figure 4 , Figure 4 Flowchart of the trapping capability detection method based on network security device linkage provided by an embodiment of the present invention. Figure 4 As shown, the trapping capability detection method based on network security device linkage includes the following steps: S01. The device linkage module obtains suspicious traffic data captured by at least one network security device connected to it.

[0047] In this embodiment, the device linkage module obtains suspicious traffic data captured by at least one network security device connected thereto, including the following steps: S011. Obtain the flow data size of each network security device connected to the device linkage module respectively.

[0048] It is understandable that the traffic data refers to the total size of all network data packets captured by network security devices (such as firewalls, intrusion detection systems, intrusion prevention systems, etc.) within a certain time range.

[0049] S012. Set a corresponding polling time interval according to the flow data size of each network security device.

[0050] In this embodiment, the polling time interval corresponding to any network security device refers to the time interval at which the device linkage module periodically obtains log records from the corresponding network security device.

[0051] It is understandable that, on the one hand, the greater the data flow of the network security device load, the more frequent polling is required, but if the polling time interval is too short, that is, the polling frequency is too high, the device linkage module will frequently request the corresponding network security device, which will not only lead to excessive resource consumption and increase the network burden, but also affect the normal operation of the network security device load; on the other hand, network security devices with smaller data flow can be polled less frequently to save system resources.

[0052] Specifically, the polling interval of any network security device is set by the following model: ,in, Indicates the polling interval of the device linkage module for network security device i. Indicates the maximum data flow rate loaded by all network security devices. Indicates the data traffic of network security device i load, Indicates the minimum polling interval allowed for all network security devices. represents the control coefficient, Represents the total data traffic loaded by all network security devices, Indicates a decimal term.

[0053] Furthermore, in the above polling time interval setting model, the control coefficient The value range is The specific value is determined by the performance of network security equipment and the volatility of network traffic data: For high-performance equipment and high traffic fluctuation scenarios, the control coefficient For low flow and low performance equipment, the control coefficient Lower value; decimal point The value range is , which is set to avoid division by zero errors caused by zero data flow on the network security device load. Usually, it is set to , to ensure that the polling interval is reasonable when the traffic is extremely small.

[0054] The polling time interval setting model provided in this embodiment can enable the device linkage module to intelligently allocate polling frequencies when facing multiple network security devices, thereby avoiding overly frequent or overly sparse polling of each network security device.

[0055] Further, at any polling time node set based on the polling time interval: S0121. Send a first data request to a corresponding network security device, and obtain log records within a corresponding polling time interval based on the first data request.

[0056] In this embodiment, the first data request is a request sent by the device linkage module to the network security device, for obtaining log records of the device within a certain time interval.

[0057] What we know is that these log records provide summary information about network traffic, including the source IP of the traffic, the destination IP, the traffic size, the protocol type, and preliminary information on whether the traffic is marked as suspicious.

[0058] S0122. According to the suspicious traffic data record in the log record, send a second data request to the corresponding network security device, and obtain the suspicious traffic data based on the second data request.

[0059] In this embodiment, the second data request is a further request sent by the device linkage module to the network security device after detecting a record of suspicious traffic data, for obtaining detailed traffic data related to the suspicious traffic data. It is understandable that the second data request is triggered only when suspicious traffic data is detected in the log record returned by the first data request.

[0060] It should be noted that, unlike the first data request, the second data request does not obtain log summary information, but the original network data packets involving suspicious traffic or more detailed traffic information.

[0061] S02. The suspicious traffic guiding module transmits the suspicious traffic data obtained by the device linkage module to the honeypot trapping module.

[0062] In this embodiment, the suspicious traffic guiding module transmits the suspicious traffic data obtained by the device linkage module to the honeypot trapping module, including the following steps: S021. According to the network security device source of the suspicious traffic data, match the guiding path of the suspicious traffic data from the device linkage module to the honeypot trapping module, wherein the end point of the guiding path is a honeypot instance in the honeypot trapping module corresponding to the network security device source.

[0063] Further, when the number of honeypot instances corresponding to the network security device source in the honeypot trapping module is two or more, the suspicious traffic guiding module transmits the suspicious traffic data obtained by the device linkage module to the honeypot trapping module, and further includes the following steps: S022. Filter out an optimal transmission path from the guide path according to the load size of each honeypot instance corresponding to the network security device source, wherein the end point of the optimal transmission path is the honeypot instance with the smallest load among the multiple honeypot instances corresponding to the network security device source.

[0064] S03. The honeypot instance simulates the target network environment, and obtains attack behavior characteristics of the suspicious traffic data according to the attack behavior of the suspicious traffic data on the simulated network environment.

[0065] Furthermore, the honeypot instance simulates real network services (such as web servers, databases, enterprise servers, etc.) to guide attackers to perform further malicious operations and record their interaction processes.

[0066] By analyzing these attack behaviors, the honeypot instance can identify and extract the attacker's attack behavior characteristics, including attack patterns, tools used, intentions, steps, etc.; these attack behavior characteristics help to gain a deeper understanding of the attacker's methods and provide data support for the optimization of defense strategies.

[0067] S04. The trapping capability detection module evaluates the trapping capability of the honeypot trapping module according to the attack behavior trapping result of the honeypot trapping module.

[0068] In this embodiment, the trapping capability detection module evaluates the trapping capability of the honeypot trapping module based on the attack behavior trapping results of the honeypot trapping module, including the following steps: obtaining the trapping success rate implemented by each honeypot in the honeypot trapping module respectively, and the trapping success rate is the ratio of the number of effective attacks captured by the honeypot instance to the total number of suspicious traffic data transmitted to the honeypot instance.

[0069] Furthermore, the trapping capability detection module evaluates the trapping capability of the honeypot trapping module according to the attack behavior trapping result of the honeypot trapping module, and further includes the following steps: The honeypot trapping module response efficiency corresponding to each network security device is obtained respectively, where the honeypot trapping module response efficiency is an average response time of one or more honeypot instances corresponding to the network security device to a group of suspicious traffic data.

[0070] S05. The honeypot management module adjusts the deployment of honeypot instances in the honeypot trapping module according to the evaluation result of the trapping capability detection module.

[0071] In this embodiment, the honeypot management module adjusts the deployment of the honeypot instances in the honeypot trapping module according to the evaluation result of the trapping capability detection module, including the following steps: According to the trapping success rate of each honeypot instance in the honeypot trapping module, the configuration resources of the corresponding honeypot instance are adjusted respectively.

[0072] Specifically, according to the trapping success rate of the honeypot instance, configuration resources such as computing resources, memory, bandwidth, storage space, etc. are dynamically increased, decreased, or kept unchanged.

[0073] For example, the honeypot instance with a high trapping success rate maintains the current resource configuration; the honeypot instance with a low trapping success rate increases the resource configuration to ensure that each honeypot instance of the entire honeypot trapping module achieves a high trapping success rate.

[0074] Furthermore, the honeypot management module adjusts the deployment of the honeypot instances in the honeypot trapping module according to the evaluation result of the trapping capability detection module, and further includes the following steps: According to the response efficiency of the honeypot trapping module corresponding to each network security device, the number of honeypot instances corresponding to each network security device is adjusted respectively.

[0075] Specifically, according to the response efficiency of the honeypot trapping module corresponding to each network security device, the number of honeypot instances corresponding to the network security device is increased, maintained or decreased.

[0076] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or replace some or all of the technical features therein with equivalents.

Claims

1. A trapping capability detection system based on network security device linkage, characterized in that: include: A device linkage module, each of which is connected to at least one network security device in the target network environment, and is used to obtain suspicious traffic data captured by at least one network security device connected thereto; A honeypot trapping module, the honeypot trapping module includes at least one honeypot instance, the honeypot instance is used to simulate the target network environment, and obtain the attack behavior characteristics of the suspicious traffic data according to the attack behavior of the suspicious traffic data on the simulated network environment; A suspicious traffic guiding module, the suspicious traffic guiding module is connected to the device linkage module and the honeypot trapping module respectively, and the suspicious traffic guiding module is used to transmit the suspicious traffic data obtained by the device linkage module to the honeypot trapping module; A trapping capability detection module, the trapping capability detection module is connected to the honeypot trapping module, and the trapping capability detection module is used to evaluate the trapping capability of the honeypot trapping module according to the attack behavior trapping result of the honeypot trapping module; A honeypot management module, the honeypot management module is connected to the trapping capability detection module and the honeypot trapping module respectively, and the honeypot management module is used to adjust the deployment of honeypot instances in the honeypot trapping module according to the evaluation result of the trapping capability detection module.

2. The trapping capability detection system based on network security device linkage according to claim 1 is characterized in that: The device linkage module is connected to each network security device in the target network environment through a unique communication channel, each of the communication channels corresponds to a communication protocol, and the communication protocol is used to support data transmission between the device linkage module and the corresponding network security device.

3. The trapping capability detection system based on network security device linkage according to claim 2 is characterized in that: Each of the honeypot instances receives suspicious traffic data of only one network security device, and each of the suspicious traffic data of the network security device is received by at least one honeypot instance.

4. The trapping capability detection system based on network security device linkage according to claim 3 is characterized in that: The device linkage module obtains suspicious traffic data captured by at least one network security device connected thereto, including the following steps: Respectively obtain the flow data size of each network security device connected to the device linkage module; According to the flow data size of each network security device, a corresponding polling time interval is set. At any polling time node set based on the polling time interval: Sending a first data request to a corresponding network security device, and obtaining log records within a corresponding polling time interval based on the first data request; According to the suspicious traffic data record in the log record, a second data request is sent to the corresponding network security device, and the suspicious traffic data is obtained based on the second data request.

5. The trapping capability detection system based on network security device linkage according to claim 3 is characterized in that: The suspicious traffic guiding module transmits the suspicious traffic data obtained by the device linkage module to the honeypot trapping module, including the following steps: According to the network security device source of the suspicious traffic data, a guiding path of the suspicious traffic data from the device linkage module to the honeypot trapping module is matched, and the end point of the guiding path is a honeypot instance in the honeypot trapping module corresponding to the network security device source.

6. The trapping capability detection system based on network security device linkage according to claim 5 is characterized in that: When the number of honeypot instances corresponding to the network security device source in the honeypot trapping module is two or more, the suspicious traffic guiding module transmits the suspicious traffic data obtained by the device linkage module to the honeypot trapping module, and further includes the following steps: According to the load size of each honeypot instance corresponding to the network security device source, an optimal transmission path is screened from the guide path, and the end point of the optimal transmission path is the honeypot instance with the smallest load among the multiple honeypot instances corresponding to the network security device source.

7. The trapping capability detection system based on network security device linkage according to claim 3 is characterized in that: The trapping capability detection module evaluates the trapping capability of the honeypot trapping module according to the attack behavior trapping result of the honeypot trapping module, including the following steps: The trapping success rate of each honeypot in the honeypot trapping module is obtained respectively, and the trapping success rate is the ratio of the number of effective attacks captured by the honeypot instance to the total number of suspicious traffic data transmitted to the honeypot instance.

8. The trapping capability detection system based on network security device linkage according to claim 7 is characterized in that: The honeypot management module adjusts the honeypot instance deployment in the honeypot trapping module according to the evaluation result of the trapping capability detection module, including the following steps: According to the trapping success rate of each honeypot instance in the honeypot trapping module, the configuration resources of the corresponding honeypot instance are adjusted respectively.

9. The trapping capability detection system based on network security device linkage according to claim 8 is characterized in that: The trapping capability detection module evaluates the trapping capability of the honeypot trapping module according to the attack behavior trapping result of the honeypot trapping module, and further comprises the following steps: The honeypot trapping module response efficiency corresponding to each network security device is obtained respectively, where the honeypot trapping module response efficiency is an average response time of one or more honeypot instances corresponding to the network security device to a group of suspicious traffic data.

10. The trapping capability detection system based on network security device linkage according to claim 9 is characterized in that: The honeypot management module adjusts the honeypot instance deployment in the honeypot trapping module according to the evaluation result of the trapping capability detection module, and further includes the following steps: According to the response efficiency of the honeypot trapping module corresponding to each network security device, the number of honeypot instances corresponding to each network security device is adjusted respectively.

Images