Simulation method and system based on honeypot network in attack trapping system

Abstract

The invention relates to the technical field of network security implementation countermeasures, in particular to a honeypot network simulation method and system based on an attack trapping system, and the method comprises the steps: constructing a honeypot network of which each level comprises a plurality of honeyspots and an attack instruction, and obtaining the impact defense demand evaluation of the attack instruction and the deployment integrity of an attack link; comparing the stability condition of the current attack instruction to obtain a file type decoy factor of the attack instruction; adjusting the authorization condition of an authorized trapping file corresponding to a threat target type by using the file type decoy factor under an attack instruction of a next attack order, and obtaining the anti-recognition probability of the current attack instruction in combination with the threat rating change of the current attack instruction and the next attack instruction; and a prior attack interaction link is obtained according to the anti-recognition probability, and trapping of an attacker is realized. The invention aims at dynamically trapping attackers by the honeypot network according to the tactical purpose tendency of the attack instruction, and increasing the trapping interaction times of the honeypot network.

Description

Technical Field

[0001] The present invention relates to the technical field of network security implementation countermeasures, and in particular to a honeypot network simulation method and system based on an attack trapping system. Background Art

[0002] Honeypot network simulation is an attack trapping method used to protect server security. It actively exposes some tempting and important virtual resources to attackers through the constructed honeypot network, thereby attracting attackers to attack. Security personnel monitor the logs of the interaction between attackers and the honeypot network to understand the attackers' attack methods, tools used, attack targets and attack intentions, and then improve the server's security strategy, strengthen defense measures and trace the attackers.

[0003] The behaviors of attackers when attacking the server will be recorded in the threat intelligence of the honeypot network and the attack and defense logs of the server. However, the attackers attack the server blindly, which leads to a large number of trial-and-error attack instructions when analyzing the attack and defense logs. As a result, there is not much available information in the attack and defense logs for security personnel to understand the attacker's attack purpose, which affects the targeted assessment of the attacker and reduces the accuracy of the honeypot network in capturing attack behaviors. Summary of the invention

[0004] The present invention provides a honeypot network simulation method and system based on an attack trapping system to solve the existing problems.

[0005] The honeypot network simulation method and system based on the attack trapping system of the present invention adopt the following technical solutions: An embodiment of the present invention provides a honeypot network simulation method based on an attack trapping system, the method comprising the following steps: Constructing a honeypot network including a plurality of honey points at each level, wherein the honey points include a plurality of authorized trapping files; Construct attack instructions that include attack sequence, targeting level, and threat target type; Get the threat rating of the attack instructions and the number of threat files; The number of threat files and threat ratings are used to reflect the threat situation of attack instructions, and the defense impact demand evaluation of attack instructions is obtained; Analyze the attack sequence of attack instructions and the degree of intrusion into the honeypot network layer to obtain the attack link deployment integrity of the attack instructions; Compare the stability of the defense impact demand evaluation of the current attack instruction with that of the previous attack order attack instruction, and combine the attack link deployment integrity of the current attack instruction to obtain the file type deception factor of the honeypot network for the current attack instruction; Using the file type deception factor under the attack instruction of the next attack order, adjusting the authorization status of the authorized trapping file corresponding to the threat target type, combining the threat rating changes of the current attack instruction and the next attack instruction, to obtain the anti-recognition probability of the current attack instruction; The attack instructions are sequentially implemented and judged according to the anti-identification probability to obtain a priori attack interaction links; The attacker is lured and trapped by using the prior attack interaction link.

[0006] Preferably, the specific steps of obtaining the defense impact demand evaluation include: The first The attack instruction's target level is recorded as Level; The first The threat target type of the attack instruction is recorded as type; The first Level The number of authorized trap files of the type is recorded as ; The first The number of threat files of attack instructions is recorded as ; The first The attack instruction is in The total number of trap files accessed in the hierarchy is recorded as ; No. Evaluation of defense impact requirements for attack instructions The calculation method is: in, To preset hyper parameters; For the The threat rating of the attack instructions, For the The maximum threat rating of all attack instructions before the attack order of the attack instruction.

[0007] Preferably, the specific steps of acquiring the attack link deployment integrity include: Record the current attack command as Attack instructions; The first The number of first appearances of all attack instructions in the attack order before the attack instruction is recorded as Number of intrusion levels of attack instructions ; No. The attack chain deployment integrity of the attack instructions The calculation method is: in, For the The attack order of the attack instructions.

[0008] Preferably, the specific steps of comparing the stability of the defense impact demand evaluation of the current attack instruction with that of the previous attack order attack instruction and combining the attack link deployment integrity of the current attack instruction to obtain the file type deception factor of the honeypot network for the current attack instruction include: Compare the defense impact demand of the current attack instruction with that of the previous attack order attack instruction to evaluate the deviation degree of the tactical purpose of the current attack instruction; According to the deviation degree of the tactical purpose of the current attack instruction and the attack link deployment integrity of the current attack instruction, the file type deception factor of the honeypot network for the current attack instruction is obtained.

[0009] Preferably, the specific steps of obtaining the degree of deviation from the tactical objective include: The defense impact demand evaluations of all attack instructions before the attack order of the current attack instruction are obtained and recorded as the defense impact demand evaluations of the historical attack instructions. The skewness of the defense impact demand evaluations of all historical attack instructions relative to the defense impact demand evaluation of the current attack instruction is calculated and recorded as the degree of deviation from the tactical objective of the current attack instruction.

[0010] Preferably, the specific steps of obtaining the file type deception factor include: The reciprocal of the absolute value of the deviation degree of the tactical purpose of the current attack instruction and the product of the attack link deployment integrity of the current attack instruction are recorded as the file type deception factor of the current attack instruction; The inversely proportional result of the degree of deviation of the tactical objective of the current attack instruction is used to reflect the stability of the defense impact demand evaluation of the current attack instruction relative to the previous attack order attack instruction.

[0011] Preferably, the specific steps of using the file type deception factor under the attack instruction of the next attack order to adjust the authorization status of the authorized trapping file corresponding to the threat target type, and combining the threat rating change of the current attack instruction and the next attack instruction to obtain the anti-recognition probability of the current attack instruction include: Preset initial reward amount; When the first attack instruction is executed, the initial reward amount is recorded as the reward amount of the first attack instruction; According to the file type deception factor of the honeypot network for the first attack instruction, the reward amount of the first attack instruction is adjusted to obtain the reward amount of the second attack instruction; And so on, the reward amount of the attack command of the next attack sequence is obtained; According to the reward amount of the attack instruction of the next attack sequence, the authorization status of the authorized trapping file corresponding to the threat target type of the attack instruction of the next attack sequence is adjusted; According to the reward amount and threat rating of the attack instruction of the next attack sequence, the anti-recognition probability of the current attack instruction is obtained.

[0012] Preferably, the specific steps of obtaining the reward amount of the attack instruction of the next attack order include: The attack instruction of the next attack sequence is recorded as Attack instructions; No. The reward amount for attack commands is obtained as follows: The first The reward amount for attacking an attack instruction is recorded as ; No. The reward amount for attack commands The calculation method is: For the honeypot network File type deception factors of attack instructions, It is the premnmx function.

[0013] Preferably, the specific steps of obtaining the prior attack interaction link include: A detection threshold is preset. If the anti-recognition probability of the current attack instruction is greater than or equal to the detection threshold, the reward amount of the next attack instruction corresponding to the next attack instruction in the next attack order is stopped from being adjusted. If the anti-recognition probability of the current attack instruction is less than the detection threshold, the reward amount of the next attack instruction corresponding to the next attack instruction in the next attack order is adjusted through the reward amount of the next attack instruction; After obtaining the anti-recognition probability of each attack instruction, all attack instructions are executed sequentially, and the number of authorized trapping files of each type of file at each level in the honeypot network is used as a priori attack interaction link.

[0014] The present invention also proposes a honeypot network simulation system based on the attack trapping system, which includes a memory, a processor, and a computer program stored in the memory and running on the processor. When the processor executes the computer program, the steps of the above method are implemented.

[0015] The beneficial effects of the technical solution of the present invention are: constructing a honeypot network containing several honey points at each level; constructing attack instructions containing attack order, level and threat target type; obtaining the threat rating and number of threat files of the attack instruction; using the number of threat files and threat rating to reflect the threat situation of the attack instruction, and obtaining the defense impact demand evaluation of the attack instruction; the defense impact demand evaluation can reflect the clarity of the tactical purpose of the attack instruction, and distinguish between interference attack instructions and attack instructions with clear tactical purposes; analyzing the attack order of the attack instruction and the degree of intrusion into the honeypot network level, and obtaining the attack link deployment integrity of the attack instruction; the attack link deployment integrity reflects the degree to which the virtual attacker is deceived by the honeypot network, and the greater the degree of deception, the easier it is for the honeypot network to be discovered by the virtual attacker, and the greater the degree of deception required for the attacker; comparing the current attack instruction with the Based on the stability of the defense impact demand evaluation of the attack instructions of the previous attack sequence, combined with the attack link deployment integrity of the current attack instruction, the file type deception factor of the honeypot network for the current attack instruction is obtained; it reflects the degree of adjustment of the authorization status of the authorized trapping file corresponding to the threat target type, which is used to continue the interaction between the honeypot network and the virtual attacker; under the attack instructions of the next attack sequence, the file type deception factor is used to adjust the authorization status of the authorized trapping file corresponding to the threat target type, and combined with the threat rating changes of the current attack instruction and the next attack instruction, the anti-recognition probability of the current attack instruction is obtained; it reflects the virtual attacker's recognition of the honeypot network; according to the anti-recognition probability, the attack instructions are sequentially implemented and judged to obtain a priori attack interaction link; the priori attack interaction link is used to induce the attacker to achieve trapping of the attacker. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 It is a flow chart of the steps of the honeypot network simulation method based on the attack trapping system of the present invention; Figure 2 A schematic diagram of a honeypot network proposed in an embodiment of the present invention; Figure 3 A flowchart of sequentially executing attack instructions proposed by one embodiment of the present invention. DETAILED DESCRIPTION

[0018] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the following is a detailed description of the honeypot network simulation method and system based on the attack trapping system proposed by the present invention, its specific implementation method, structure, features and effects, in conjunction with the accompanying drawings and preferred embodiments. In the following description, different "one embodiment" or "another embodiment" does not necessarily refer to the same embodiment. In addition, specific features, structures or characteristics in one or more embodiments may be combined in any suitable form.

[0019] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0020] The specific scheme of the honeypot network simulation method and system based on the attack trapping system provided by the present invention is described in detail below with reference to the accompanying drawings.

[0021] See also Figure 1 , which shows a flow chart of the steps of a honeypot network simulation method based on an attack trapping system provided by an embodiment of the present invention, the method comprising the following steps: Traditional honeypot networks analyze the attacker's intentions based on the attack and defense logs recorded by the server, and randomly release virtual important information through honeypots to guide the attacker to attack virtual resources, and then adjust the server's protection strategy after inducing the attacker; however, the attacker behavior analyzed by the traditional honeypot network mainly depends on the interaction between the honeypot and the attacker. When the type of important information released by the honeypot is different from the attacker's attack type, invalid records will exist in the attack and defense logs, and the different types will also reduce the number of interactions between the attacker and the honeypot, causing the attacker to see through the honeypot too early, causing the server's deception defense to fail.

[0022] In order to solve the above problems, this embodiment proposes a honeypot network simulation method based on an attack trapping system. The method constructs an attack instruction of a virtual attacker, and the attack instruction has an attack order. The virtual attacker attacks the honeypot network according to the attack order. The honeypot network analyzes the attack situation of each attack instruction on the decoy file under the honey point in the honeypot network, analyzes the type of the attacked decoy file, and adjusts the proportion of the corresponding type of decoy file in the honey point, so that the next attack instruction is more inclined to the file type expected by the current attack instruction, thereby preventing the attacker from seeing through the honeypot network too early, increasing the number of interactions between the attacker and the honeypot, and generating a priori attack interaction links according to the attack order based on the virtual attacker's attack instructions on the honeypot network. When the attack of the actual attacker's attack instruction is the same as the priori attack interaction link, the priori attack interaction link is used to induce the attacker to reduce the difficulty of analysis.

[0023] In this embodiment, the specific steps of the honeypot network simulation method based on the attack trapping system are as follows: Step S001, construct a honeypot network containing several honeypots at each level; construct an attack instruction containing an attack sequence, a level and a threat target type, and obtain a threat rating and a number of threat files of the attack instruction.

[0024] It should be noted that this embodiment increases the number of interactions between the attacker and the honeypot, and then analyzes the attack instructions to increase the number of interactions and generate a priori attack interaction links. Therefore, a honeypot network of the attack trapping system and the attack instructions of the virtual attacker are first constructed.

[0025] Preferably, the honeypot network constructed in this embodiment is as follows: An initialization network is constructed, wherein the initialization network is a tree-type network topology structure, the initialization network contains several levels, and each level contains several network nodes; it should be noted that constructing an initialization network is a prior art, and this embodiment does not specifically limit the construction of the initialization network, and the initialization configuration of each node in the initialization network, such as port information and other well-known operations are not repeated in this embodiment.

[0026] A number of prior trapping files of the same file type are stored in each node, wherein the file types include images, data, structured data, unstructured data, etc.; Divide all the trap files in each node into equal parts, record half of them as authorized trap files, and the other half as unauthorized trap files; Randomly mark several nodes as honey points to form a honeypot network; It should be noted that the authorized entrapped files are files that the attacker can access, and the unauthorized entrapped files are files that the attacker cannot access. This embodiment does not limit the classification of the authorization of entrapped files, and other embodiments can adjust the proportion of authorized files. Figure 2 As shown, it is a schematic diagram of the honeypot network of the tree-type network topology structure described in this embodiment, which includes three levels, each level includes a number of nodes, and the nodes marked with "stars" are honeypots.

[0027] Preferably, the steps of constructing the attack instruction in this embodiment are: It should be noted that the attack instruction of this embodiment is threat intelligence in the format of Structured Threat Information Expression (STIX). Structured Threat Information Expression is a language and serialization format used to exchange Cyber ​​Threat Intelligence (CTI), usually in json data format, which is used to store the information of attack instructions and the targeted objects.

[0028] Several attack instructions are constructed, each of which includes an attack order, a targeted level, an expected number of attack files, a threat keyword set, and a threat target type. It should be noted that the attack order and the targeted level of the attack instructions do not correspond, and the level is random in the sequential attack order. In this embodiment, a total of 50 attack instructions are constructed for description, wherein the threat keyword is a keyword that the attack instruction matches under the threat target type, and is used to match the attack instruction with the entrapped file in the honey spot that needs to be attacked.

[0029] It is particularly important to note that, since attackers have obvious targets when attacking servers, the several attack instructions constructed in this embodiment are designed to simulate attacks by real attackers as much as possible, so the threat target types and threat keywords of the attack instructions are highly similar.

[0030] Therefore, the keywords of all the trapped files of the file type corresponding to the threat target type of the attack instruction are obtained through the Jieba word segmentation algorithm and the TF-TDF algorithm, which are recorded as the intended matching keywords of each attack instruction. The word vector is constructed using the threat keywords and intended matching keywords of each attack instruction. The similarity between each threat keyword and all intended matching keywords in the threat keyword set of each attack instruction is obtained through the cosine similarity algorithm. The mean value of the similarity is recorded as the threat rating of the attack instruction. The threat rating of the attack instruction ranges from .

[0031] It should be noted that the more similar each threat keyword in the threat keyword set is to the intended matching keyword in the trap file, the easier it is for the attack instruction to attack the node or honey spot containing the trap file, that is, the higher the threat of the attack instruction to the server; the jieba word segmentation algorithm and the TF-TDF algorithm are existing public technologies and will not be repeated in this embodiment.

[0032] Furthermore, the attack instructions are connected to the honeypot network, and the number of trapped files accessed by the attacked instructions in all honey spots at the same level for each attack instruction is obtained through the honeypot network log record, which is recorded as the number of threat files for each attack instruction; the number of trapped files accessed by the attacked instructions represents the number of authorized trapped files of the file type corresponding to the threat target type of the attack instruction.

[0033] Step S002: The threat situation of the attack instruction is reflected by the number of threat files and the threat rating, and a defense impact demand evaluation of the attack instruction is obtained.

[0034] It should be noted that the tactical purpose of the virtual attacker is unknown to the honeypot network, but during the attack process, as the attack order of the attack instructions increases, the tactical purpose will gradually be exposed, which is reflected in the number of threat files in the attack instructions accessing all the trapped files in the honeypot network.

[0035] It should be further explained that the attack instructions of the virtual attacker do not completely meet the tactical purpose of the attack. Some attack instructions need to be interfered to prevent the server from easily identifying the attack instructions. Therefore, some attack instructions are used to interfere with the server to avoid exposing the attack purpose. If the current attack instruction is more in line with the tactical purpose of the virtual attacker, when the threat keywords in the attack instruction match the entrapped files in the honey spot, the attack instruction accesses more entrapped files and the threat rating of the attack instruction is greater. Therefore, more entrapped files of the same file type as the threat target type are accessed in the honey spot, and the attack instruction requires a greater defense impact on the server.

[0036] Preferably, the specific steps of using the number of threat files and threat ratings to reflect the threat situation of the attack instruction and obtaining the defense impact demand evaluation of the attack instruction are: The first The attack instruction's target level is recorded as Level; The first The threat target type of the attack instruction is recorded as type; The first Level The number of authorized trap files of the type is recorded as ; The first The number of threat files of attack instructions is recorded as ; The first The attack instruction is in The total number of trap files accessed in the hierarchy is recorded as ; No. Evaluation of defense impact requirements for attack instructions The calculation method is: in, To preset the hyperparameters, this embodiment takes Used to avoid the denominator being 0; For the The threat rating of the attack instructions, For the The maximum threat rating of all attack instructions before the attack order of the attack instruction.

[0037] It should be noted that Indicates Among all authorized trap files corresponding to the threat target type of the attack instruction, The number of trap files that are not accessed by the attack instructions. The smaller the value, the higher the The attack instruction is in The greater the total number of trap files accessed in a level, the higher the The greater the threat of an attack instruction to an authorized trap file of the target type; Indicates The threat rating of the attack instruction. The larger the value, the more it can show the purpose of the attack among all the previous attack instructions.

[0038] At this point, the defense impact demand evaluation of each attack command has been obtained. The defense impact demand evaluation can reflect the clarity of the tactical purpose of the attack command and distinguish between interference attack commands and attack commands with clear tactical purposes.

[0039] Step S003: Analyze the attack sequence of the attack instructions and the degree of intrusion into the honeypot network layer to obtain the attack link deployment integrity of the attack instructions.

[0040] It should be noted that when an attacker attacks a server, the more attack instructions the attacker executes, the more resources the attacker steals from the server. Similarly, the more attack instructions the honeypot network traps for the attacker, the more effective the honeypot network is, and the more the analysis of the attack can reflect the attacker's tactical goals.

[0041] It should be further explained that the targeted levels of the attack instructions set in this embodiment have nothing to do with the attack order. Therefore, the more levels the executed attack instructions invade the honeypot network and the more attack instructions are executed, the more it can show that the honeypot network has not been discovered by the attacker, and then the attacker can continue to be tricked into executing the attack instructions. The honeypot network can continue to trick the attacker by releasing more unauthorized decoy files that tend to tactical purposes to the honeypot, and the more attack instructions are executed, the greater the degree of release that needs to be made.

[0042] Preferably, the specific steps of analyzing the attack sequence of the attack instructions and the degree of intrusion into the honeypot network level to obtain the attack link deployment integrity of the attack instructions are: Record the current attack command as Attack instructions; The first The number of first appearances of all attack instructions in the attack order before the attack instruction is recorded as Number of intrusion levels of attack instructions ; The first occurrence of the number for the level indicates: when executing An attack instruction is a level in all levels of the honeypot network that has been attacked by the attack instruction.

[0043] No. The attack chain deployment integrity of the attack instructions The calculation method is: in, For the The attack order of the attack instructions.

[0044] It should be noted that the larger the attack order value of the attack instruction, the more complete the attack chain of the virtual attacker has been established on the honeypot network by executing multiple attack instructions. The larger the number of intrusion levels, the more complete the attack chain of the virtual attacker has been. The more complete the tactical purpose of the virtual attacker is, the more entrapment information needs to be applied to the virtual attacker to maintain the virtual attacker's desire to attack.

[0045] At this point, the attack link deployment integrity of the current attack instruction has been obtained. The attack link deployment integrity reflects the degree to which the virtual attacker is deceived by the honeypot network. The greater the degree of deception, the easier it is for the honeypot network to be discovered by the virtual attacker, and the greater the degree of deception required for the attacker.

[0046] Step S004, compare the stability of the defense impact demand evaluation of the current attack instruction with that of the previous attack order attack instruction, and combine the attack link deployment integrity of the current attack instruction to obtain the file type deception factor of the honeypot network for the current attack instruction; use the file type deception factor under the attack instruction of the next attack order to adjust the authorization status of the authorized trapping file corresponding to the threat target type, and combine the threat rating changes of the current attack instruction and the next attack instruction to obtain the anti-recognition probability of the current attack instruction.

[0047] It should be noted that the greater the attack link deployment integrity of the current attack instruction, the more sensitive the virtual attacker is to whether he is induced by the honeypot network, that is, whether the honeypot network is discovered by the virtual attacker. If the virtual attacker cannot obtain more entrapped files in the next attack instruction, he may lose the desire to attack and terminate the interaction with the honeypot network, causing the honeypot network to lack the basis for analyzing the tactical purpose of the virtual attacker.

[0048] It should be further explained that, in this embodiment, the tactical objectives of the virtual attacker are unknown, and therefore the ratio of authorized entrapped files to unauthorized entrapped files for different file types in each preset node and honey spot is the same. However, in the process of responding to the attacker's attack instructions, the entrapped files exposed by the honey spot may not arouse the attacker's intention. When the attacker finds entrapped files that meet his tactical objectives, his attack instructions access more file types corresponding to the threat target type at the targeted level, making the defense impact demand evaluation value of the attack instruction larger. Then the honeypot network needs to release more authorization permissions for unauthorized entrapped files according to the file types corresponding to the threat target type.

[0049] It should be further explained that the honeypot network adjusts the authorization permissions mainly based on the preset fixed reward amount for each attack instruction. The reward amount is used to open the permissions of a certain proportion of unauthorized entrapped files to authorized entrapped files, thereby inducing the virtual attacker. However, in this process, if an attack instruction with a smaller attack order releases too many entrapped files, it will make it easier for the virtual attacker to detect the honeypot network. If an attack instruction with a larger attack order releases too few entrapped files, it will lead to insufficient attack desire of the virtual attacker, that is, the virtual attacker will not be interested in attacking, thereby terminating the interaction prematurely. Therefore, this embodiment analyzes the changes in the defense impact demand evaluation of different attack instructions during the execution of the attack instructions, thereby adaptively changing the reward amount for the next attack instruction, thereby improving the probability of maintaining the interaction between the virtual attacker and the honeypot network.

[0050] Preferably, the specific steps of comparing the stability of the defense impact demand evaluation of the current attack instruction with that of the previous attack order attack instruction and combining the attack link deployment integrity of the current attack instruction to obtain the file type deception factor of the honeypot network for the current attack instruction are: Honeypot network File type deception factor of attack instructions The calculation method is: in, For the The attack chain deployment integrity of the attack instructions, For the The attack order of the attack instructions, For the The standard deviation of the defense impact demand evaluation of all attack instructions before the attack order of the attack instruction, For the The attack order of the attack instruction is before Evaluation of the defensive impact demand of attack instructions, For the Evaluation of the defensive impact requirements of attack instructions; To find the absolute value function, To find the reciprocal function, To preset the hyperparameters, this embodiment takes Used to avoid denominator being 0.

[0051] in express Indicates The attack order of the attack instruction is before The defense impact demand evaluation of the attack instruction, that is, The defense impact demand evaluation of the attack instruction is used as the defense impact demand evaluation of the historical attack instruction, and the defense impact demand evaluation of all historical attack instructions is calculated relative to the first The skewness of the evaluation of the defensive impact demand of the attack instruction is recorded as the degree of deviation from the tactical purpose of the current attack instruction. The closer the value of the tactical purpose deviation is to 0, the smaller the deviation is. The skewness is a well-known technology and will not be described in detail in this embodiment. In this embodiment, the result of obtaining the inverse of the absolute value of the skewness reflects the stability of the defense impact demand evaluation of the current attack instruction relative to the previous attack order attack instruction. The larger the value, the more stable the defense impact demand evaluation. The more the attack instruction is in line with the tactical purpose of the virtual attacker, the more the deception based on the attack instruction is conducive to the continuation of the interaction and avoids the honeypot network being discovered. On the contrary, the virtual attacker is more likely to discover the deception of the honeypot network. For the The deployment integrity of the attack chain of the attack instructions reflects the completeness of the attack chain construction. The more complete the construction is, the greater the file type deception factor is, that is, more information needs to be released to continue the interaction.

[0052] At this point, after obtaining the file type deception factor of the honeypot network for the current attack command, it reflects the degree of adjustment of the authorization status of the authorized decoy file corresponding to the threat target type, which is used to continue the interaction between the honeypot network and the virtual attacker.

[0053] Preferably, the file type deception factor is used under the attack instruction of the next attack sequence to adjust the authorization status of the authorized trapping file corresponding to the threat target type, and the specific steps of obtaining the anti-recognition probability of the current attack instruction in combination with the threat rating change of the current attack instruction and the next attack instruction are: When building a honeypot network, an initial reward amount is preset. The initial reward amount of this embodiment is described by taking 10% as an example; When the first attack instruction is executed, the initial reward amount is recorded as the reward amount of the first attack instruction; According to the file type deception factor of the honeypot network for the first attack instruction, the reward amount of the first attack instruction is adjusted to obtain the reward amount of the second attack instruction; By analogy, The reward amount for attack commands is obtained as follows: The first The reward amount for attacking an attack instruction is recorded as ; No. The reward amount for attack commands The calculation method is: in, For the honeypot network File type deception factors of attack instructions, is a premnmx function, which is used to normalize the file type deception factor, and the normalization range is .

[0054] It should be noted that, in this embodiment, The file type deception factor has a value range of the bonus effect on the reward amount. When it is less than 1, it weakens the gain, and when it is greater than 1, it strengthens the gain, reflecting the The degree to which an attack order tends toward a tactical goal.

[0055] Further, The attack instructions are adjusted according to the threat target type in the hierarchy as follows: The first The number of unauthorized trap files corresponding to the threat target type in the level for the attack instruction is recorded as ; No. The number of unauthorized trap files corresponding to the threat target type in the level for the attack instructions that require authorization for: in, For the The reward amount for attack commands; The first In the unauthorized trap file corresponding to the threat target type in the target level, the attack instructions are randomly selected Change the permissions of an unauthorized trap file to an authorized trap file.

[0056] It should be noted that the virtual attacker may be able to detect the honeypot network during the execution of the attack command. The honeypot network accordingly uses the anti-identification probability to enhance its own concealment. The worse the response of the honeypot network to the attack command, the higher the probability of being detected by the virtual attacker. Conversely, the better the response of the honeypot network to the attack command, the lower the probability of being detected by the virtual attacker. That is, the response action and the detection probability are in positive feedback. In this embodiment, the response action is reflected by the reward value. The more reasonable the response action, the greater the reward value, and the stronger the anti-identification ability.

[0057] Therefore, the The anti-recognition probability of attack instructions The calculation method is: in, For the The threat rating of the attack instructions, For the The threat rating of the attack instructions, For the The reward amount for attack commands, is the maximum reward amount, is the maximum value of the reward amount; It should be noted that the calculation process of the anti-recognition probability is a known technology and will not be described in detail in this embodiment.

[0058] At this point, the anti-recognition probability of the current attack instruction is obtained, which reflects the virtual attacker's ability to detect the honeypot network. The larger the value, the greater the probability of the virtual attacker's anti-recognition.

[0059] Step S005: sequentially implement and judge the attack instructions according to the anti-identification probability to obtain a priori attack interaction link; use the priori attack interaction link to induce the attacker to trap the attacker.

[0060] After obtaining the anti-recognition probability of the current attack instruction, a detection threshold of 0.7 is preset. If the anti-recognition probability of the current attack instruction is greater than or equal to the detection threshold, it means that after executing the current attack instruction, the honeypot network is detected by the virtual attacker, and the reward amount of the next attack instruction is stopped from adjusting the reward amount of the attack instruction corresponding to the next attack instruction in the next attack order, and the reward amount of the next attack instruction is used as the reward amount of the attack instruction corresponding to the next attack order; if the anti-recognition probability of the current attack instruction is less than the detection threshold, it means that after the current attack instruction is executed, the honeypot network is not detected by the virtual attacker, and the reward amount of the next attack instruction is adjusted to the reward amount of the attack instruction corresponding to the next attack instruction in the next attack order.

[0061] Furthermore, based on the above steps, the anti-identification probability of each attack instruction is obtained and judged until all attack instructions are executed sequentially. After all attack instructions are adjusted, the number of authorized entrapped files of each type of file at each level in the honeypot network is used as a priori attack interaction link. When the attack instructions of the real attacker in the priori attack interaction link are similar, the priori attack interaction link can be used to entrap the real attacker.

[0062] like Figure 3 As shown, it shows a flowchart of sequentially executing attack instructions described in this embodiment. The specific implementation method is implemented based on existing well-known technologies, and this embodiment does not specifically limit the implementation method.

[0063] Another embodiment of the present invention provides a honeypot network simulation system based on an attack trapping system, the system includes a memory, a processor, and a computer program stored in the memory and running on the processor, when the processor executes the computer program, the above method steps S001 to S005 are implemented.

[0064] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A honeypot network simulation method based on an attack trapping system, characterized in that: The method comprises the following steps: Constructing a honeypot network including a plurality of honey points at each level, wherein the honey points include a plurality of authorized trapping files; Construct attack instructions that include attack sequence, targeting level, and threat target type; Get the threat rating of the attack instructions and the number of threat files; The number of threat files and threat ratings are used to reflect the threat situation of attack instructions, and the defense impact demand evaluation of attack instructions is obtained; Analyze the attack sequence of attack instructions and the degree of intrusion into the honeypot network layer to obtain the attack link deployment integrity of the attack instructions; Compare the stability of the defense impact demand evaluation of the current attack instruction with that of the previous attack order attack instruction, and combine the attack link deployment integrity of the current attack instruction to obtain the file type deception factor of the honeypot network for the current attack instruction; Using the file type deception factor under the attack instruction of the next attack order, adjusting the authorization status of the authorized trapping file corresponding to the threat target type, combining the threat rating changes of the current attack instruction and the next attack instruction, to obtain the anti-recognition probability of the current attack instruction; The attack instructions are sequentially implemented and judged according to the anti-identification probability to obtain a priori attack interaction links; The attacker is lured and trapped by using the prior attack interaction link.

2. According to claim 1, the honeypot network simulation method based on the attack trapping system is characterized in that: The specific steps of obtaining the defense impact demand evaluation include: The first The attack instruction's target level is recorded as Level; The first The threat target type of the attack instruction is recorded as type; The first Level The number of authorized trap files of the type is recorded as ; The first The number of threat files of attack instructions is recorded as ; The first The attack instruction is in The total number of trap files accessed in the hierarchy is recorded as ; No. Evaluation of defense impact requirements for attack instructions The calculation method is: in, To preset hyperparameters; For the The threat rating of the attack instructions, For the The maximum threat rating of all attack instructions before the attack order of the attack instruction.

3. According to claim 1, the honeypot network simulation method based on the attack trapping system is characterized in that: The specific steps of obtaining the deployment integrity of the attack link include: Record the current attack command as Attack instructions; The first The number of first appearances of all attack instructions in the attack order before the attack instruction is recorded as Number of intrusion levels of attack instructions ; No. The attack chain deployment integrity of the attack instructions The calculation method is: in, For the The attack order of the attack instructions.

4. According to claim 1, the honeypot network simulation method based on the attack trapping system is characterized in that: The specific steps of comparing the stability of the defense impact demand evaluation of the current attack instruction with that of the previous attack order attack instruction and combining the attack link deployment integrity of the current attack instruction to obtain the file type deception factor of the honeypot network for the current attack instruction include: Compare the defense impact demand of the current attack instruction with that of the previous attack order attack instruction to evaluate the deviation degree of the tactical purpose of the current attack instruction; According to the deviation degree of the tactical purpose of the current attack instruction and the attack link deployment integrity of the current attack instruction, the file type deception factor of the honeypot network for the current attack instruction is obtained.

5. According to claim 4, the honeypot network simulation method based on the attack trapping system is characterized in that: The specific steps for obtaining the degree of deviation from the tactical objective include: The defense impact demand evaluations of all attack instructions before the attack order of the current attack instruction are obtained and recorded as the defense impact demand evaluations of the historical attack instructions. The skewness of the defense impact demand evaluations of all historical attack instructions relative to the defense impact demand evaluation of the current attack instruction is calculated and recorded as the degree of deviation from the tactical objective of the current attack instruction.

6. The honeypot network simulation method based on the attack trapping system according to claim 4 is characterized in that: The specific steps of obtaining the file type deception factor include: The reciprocal of the absolute value of the deviation degree of the tactical purpose of the current attack instruction and the product of the attack link deployment integrity of the current attack instruction are recorded as the file type deception factor of the current attack instruction; The inversely proportional result of the degree of deviation of the tactical objective of the current attack instruction is used to reflect the stability of the defense impact demand evaluation of the current attack instruction relative to the previous attack order attack instruction.

7. The honeypot network simulation method based on the attack trapping system according to claim 1 is characterized in that: The specific steps of using the file type deception factor under the attack instruction of the next attack order to adjust the authorization status of the authorized trapping file corresponding to the threat target type, and combining the threat rating change of the current attack instruction and the next attack instruction to obtain the anti-recognition probability of the current attack instruction include: Preset initial reward amount; When the first attack instruction is executed, the initial reward amount is recorded as the reward amount of the first attack instruction; According to the file type deception factor of the honeypot network for the first attack instruction, the reward amount of the first attack instruction is adjusted to obtain the reward amount of the second attack instruction; And so on, the reward amount of the attack command of the next attack sequence is obtained; According to the reward amount of the attack instruction of the next attack sequence, adjusting the authorization status of the authorized trapping file corresponding to the threat target type of the attack instruction of the next attack sequence; According to the reward amount and threat rating of the attack instruction of the next attack sequence, the anti-recognition probability of the current attack instruction is obtained.

8. The honeypot network simulation method based on the attack trapping system according to claim 6 is characterized in that: The specific steps of obtaining the reward amount of the attack instruction of the next attack order include: The attack instruction of the next attack sequence is recorded as Attack instructions; No. The reward amount for attack commands is obtained as follows: The first The reward amount for attacking an attack instruction is recorded as ; No. The reward amount for attack commands The calculation method is: For the honeypot network File type deception factors of attack instructions, It is the premnmx function.

9. The honeypot network simulation method based on the attack trapping system according to claim 1 is characterized in that: The specific steps of obtaining the prior attack interaction link include: A detection threshold is preset. If the anti-recognition probability of the current attack instruction is greater than or equal to the detection threshold, the reward amount of the next attack instruction corresponding to the next attack instruction in the next attack order is stopped from being adjusted. If the anti-recognition probability of the current attack instruction is less than the detection threshold, the reward amount of the next attack instruction corresponding to the next attack instruction in the next attack order is adjusted through the reward amount of the next attack instruction; After obtaining the anti-recognition probability of each attack instruction, all attack instructions are executed sequentially, and the number of authorized trapping files of each type of file at each level in the honeypot network is used as a priori attack interaction link.

10. A honeypot network simulation system based on an attack trapping system, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the steps of the honeypot network simulation method based on the attack trapping system are implemented as described in any one of claims 1 to 9.

Images