Network security protection method and device based on mimicry environment, equipment and medium

Abstract

The invention discloses a network security protection method, device and equipment based on a mimicry environment and a medium, and relates to the technical field of network security. Basic information of a real host is input to simulate a virtual host; setting virtual sentry nodes based on the virtual host and constructing a virtual subnet, wherein the number of the virtual sentry nodes is greater than the number of nodes of a real network; based on the investigation behavior database, performing investigation behavior monitoring on nodes of a real network by adopting a non-root permission probe; when the investigation behavior is monitored, a log file of the potential risk node is called; and performing keyword matching on the log file and the cloud threat database to identify malicious scripts, and redirecting the identified malicious scripts to the virtual subnet. According to the method, the non-root permission probe is adopted to monitor the investigation behavior, so that the initial activity of an attacker can be captured, and potential risk nodes can be monitored in advance; and after the malicious script is identified, the malicious script is guided to the virtual subnet, so that the timeliness and the protection effect of network security protection are improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security protection method, device, equipment and medium based on a simulated environment. Background Art

[0002] With the rapid development of information technology, the network operation and maintenance environment is becoming increasingly complex, and security threats are emerging one after another. Traditional network security protection methods are often difficult to deal with various new security threats. For example, existing technologies can only take action after the attacker invades the server, which means that the protection measures are not predictable, which easily leads to problems of untimely protection and poor protection effect. Summary of the invention

[0003] The purpose of the embodiments of the present invention is to provide a network security protection method, device, equipment and medium based on a simulated environment, which can improve the timeliness and protection effect of network security protection.

[0004] To achieve the above object, an embodiment of the present invention provides a network security protection method based on a pseudo-environment, comprising:

[0005] Enter basic information of the real host, including protocol, host architecture and registry information;

[0006] According to the basic information, a virtual host is simulated on a virtualization platform;

[0007] Setting a virtual sentinel node based on each of the virtual hosts, and constructing a virtual subnet based on the virtual sentinel nodes; wherein the number of the virtual sentinel nodes is greater than the number of nodes in the real network;

[0008] Based on a pre-built reconnaissance behavior database, a non-root permission probe is used to monitor the reconnaissance behavior of the nodes of the real network;

[0009] When the detection behavior is monitored, the corresponding node is regarded as a potential risk node, and the log file of the potential risk node is retrieved;

[0010] The log file is matched with a pre-built cloud threat database by keywords, and when the number of matched keywords is greater than a first preset number, the corresponding subject is identified as a malicious script, and the malicious script is redirected to the virtual subnet.

[0011] As an improvement of the above solution, the non-root permission probe is installed on the real network, and the non-root permission probe is authorized using a Capability mechanism; and the reconnaissance behavior includes at least one of port scanning, vulnerability detection and brute force behavior.

[0012] As an improvement of the above solution, the detection behavior database stores the attacker's attack method, common search engine ranking method and malicious IP address.

[0013] As an improvement of the above solution, after the virtual subnet is constructed, the following steps are further included:

[0014] Obtaining traffic information of the real network through a traffic monitoring tool;

[0015] When non-standard port communication or abnormal file transfer appears in the traffic information, the corresponding subject is identified as a malicious script, and the malicious script is redirected to the virtual subnet.

[0016] As an improvement of the above solution, after the virtual subnet is constructed, the following steps are further included:

[0017] Regularly collect basic information of the real host;

[0018] When the basic information is changed, the virtual subnet is updated based on the changed basic information.

[0019] As an improvement of the above solution, after the virtual subnet is constructed, the following steps are further included:

[0020] Enter illegal command script;

[0021] Acquire actual response data of the virtual subnet to the illegal command script and new system data of the real host;

[0022] When the system data is tampered with, or when the actual response data is different from the expected response data, the configuration and policy of the virtual subnet are modified; wherein the expected response data is the response data of the real network after the illegal command script is input.

[0023] As an improvement of the above solution, the number of the virtual sentinel nodes is more than 8 times the number of nodes in the real network.

[0024] To achieve the above purpose, an embodiment of the present invention further provides a network security protection device based on a pseudo-environment, comprising:

[0025] A host information acquisition module is used to input basic information of the real host, the basic information including protocol, host architecture and registry information;

[0026] A virtual host simulation module, used to simulate a virtual host on a virtualization platform according to the basic information;

[0027] A pseudo-environment construction module, used to set up virtual sentinel nodes based on each of the virtual hosts, and to construct a virtual subnet based on the virtual sentinel nodes; wherein the number of the virtual sentinel nodes is greater than the number of nodes in the real network;

[0028] A detection behavior monitoring module is used to monitor the detection behavior of the nodes of the real network using a non-root permission probe based on a pre-built detection behavior database;

[0029] A risk node monitoring module is used to, when monitoring the detection behavior, identify the corresponding node as a potential risk node and retrieve the log file of the potential risk node;

[0030] The traffic diversion module is used to match the log file with a pre-built cloud threat database by keywords. When the number of matched keywords is greater than a first preset number, the corresponding subject is identified as a malicious script and the malicious script is redirected to the virtual subnet.

[0031] To achieve the above-mentioned objectives, an embodiment of the present invention also provides a network security protection device based on a pseudo-environment, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, it implements the network security protection method based on the pseudo-environment as described in any of the above embodiments.

[0032] To achieve the above-mentioned purpose, an embodiment of the present invention also provides a computer-readable storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the network security protection method based on the pseudo-environment as described in any of the above embodiments.

[0033] Compared with the prior art, the network security protection method, device, equipment and medium based on the simulated environment provided by the embodiments of the present invention input the basic information of the real host, and the basic information includes the protocol, host architecture and registry information; according to the basic information, a virtual host is simulated on the virtualization platform; a virtual sentinel node is set based on each of the virtual hosts, and a virtual subnet is constructed based on the virtual sentinel nodes; wherein the number of the virtual sentinel nodes is greater than the number of nodes in the real network; based on a pre-built reconnaissance behavior database, a non-root permission probe is used to monitor the reconnaissance behavior of the nodes of the real network; when the reconnaissance behavior is monitored, the corresponding node is used as a potential risk node, and the log file of the potential risk node is retrieved; the log file is matched with a pre-built cloud threat database for keywords, and when the number of matched keywords is greater than a first preset number, the corresponding subject is identified as a malicious script, and the malicious script is redirected to the virtual subnet. The embodiment of the present invention can capture the initial activities of attackers by using non-root permission probes to monitor the reconnaissance behavior, so as to monitor the potential risk nodes in advance, and after identifying the malicious scripts, it also directs them to the pre-built virtual subnet to protect the real host, thereby greatly improving the timeliness and protection effect of network security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 It is a flow chart of a network security protection method based on a pseudo-environment provided by an embodiment of the present invention;

[0035] Figure 2 It is a structural schematic diagram of a network security protection device based on a mimic environment provided by an embodiment of the present invention;

[0036] Figure 3 It is a structural schematic diagram of a network security protection device based on a pseudo-environment provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0037] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0038] In the description of this application, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in this application can be understood according to specific circumstances.

[0039] It is worth noting that, for the sake of convenience, the embodiment of the present invention takes the intrusion of WebShell as an example for explanation, but the method described in the embodiment of the present invention is also applicable to the protection of other types of network attacks, and the type of network attacks is not limited here. It can be understood that WebShell is a malicious script often used by attackers, and its purpose is to obtain the execution operation permission of the server (such as executing system commands), steal user data, delete web pages and modify homepages, etc., and its harm is self-evident.

[0040] See also Figure 1 , is a network security protection method based on a pseudo-environment provided by an embodiment of the present invention, comprising S1 to S6:

[0041] S1. Input basic information of the real host, including protocol, host architecture and registry information;

[0042] S2. Simulating a virtual host on a virtualization platform according to the basic information;

[0043] S3, setting a virtual sentinel node based on each of the virtual hosts, and building a virtual subnet based on the virtual sentinel nodes; wherein the number of the virtual sentinel nodes is greater than the number of nodes in the real network;

[0044] S4, based on the pre-built reconnaissance behavior database, using a non-root permission probe to monitor the reconnaissance behavior of the nodes of the real network;

[0045] S5. When the detection behavior is monitored, the corresponding node is regarded as a potential risk node, and the log file of the potential risk node is retrieved;

[0046] S6. Perform keyword matching on the log file and a pre-built cloud threat database. When the number of matched keywords is greater than a first preset number, identify the corresponding subject as a malicious script, and redirect the malicious script to the virtual subnet.

[0047] Exemplarily, in step S1, the basic information may also include network settings, service configurations, and applications. Further, in steps S2 and S3, a mimic system may be created using Docker (application container engine), and network settings, service configurations, and applications similar to those of a real host may be configured in the mimic system (virtual subnet) to ensure that the mimic environment can respond to common network requests and service calls. Further, when the configuration of the real host changes, the settings of the mimic system should also be modified accordingly to maintain the simulation degree and effectiveness of the mimic system. Therefore, the basic information of the real host may be collected regularly, and the mimic system may be updated when the basic information is updated. Compared with the prior art, the embodiments of the present invention, by constructing a mimic system close to the real host environment, can redirect a suspicious or unauthorized Webshell to the mimic system after detecting it, thereby protecting the real host.

[0048] Furthermore, attackers usually conduct reconnaissance activities to obtain information about the target system before the actual attack, such as port scanning, vulnerability detection, and brute force behavior. Therefore, the embodiment of the present invention installs non-root permission probes on the nodes of the real network, and detects the attacker's reconnaissance behavior through the non-root permission probes to perceive network attacks in advance.

[0049] Compared with the prior art, the embodiment of the present invention can effectively capture the initial activities of attackers by installing non-root permission probes on the real network, and take preventive measures to prevent further expansion of the attack, thereby effectively improving the predictability of network security protection technology and improving the protection effect.

[0050] Furthermore, the detection results of the reconnaissance behavior can be comprehensively analyzed together with the traffic monitoring results to determine potential risk nodes.

[0051] Furthermore, in step S4, the security information and event management (SIEM) system can be used to obtain the server access log, that is, the log file. After that, the cloud threat database and the log file are matched with keywords. When the number of matched keywords is greater than the first preset number, the corresponding subject is identified as a malicious script, and the malicious script is redirected to the mimicry system. Among them, the cloud threat database is constructed based on known Webshell features and malicious code signatures. It is worth noting that the analysis of the log file can be carried out after the attacker's reconnaissance behavior is monitored, or it can be performed regularly, which is not limited here.

[0052] Compared with the prior art, the embodiment of the present invention can capture the initial activities of attackers by installing non-root permission probes on the real network, so as to take defensive measures in advance; and, the embodiment of the present invention can divert malicious scripts into the mimicry system after detecting them by constructing a mimicry system close to the real host environment, so as to protect the real host and improve the network security protection effect.

[0053] As an optional implementation manner, the non-root permission probe is installed on the real network, and the non-root permission probe is authorized using a Capability mechanism; and the reconnaissance behavior includes at least one of port scanning, vulnerability detection, and brute force behavior.

[0054] It is worth noting that the Capability mechanism can achieve fine-grained control of permissions, allowing administrators to configure permissions according to specific needs, thereby meeting the diverse functional requirements of the system and being highly flexible; and, since non-root permission probes do not run under root permissions, even if they are discovered or exploited by attackers, the potential harm to the system is limited to a smaller range, thereby minimizing security risks and improving system security. Compared with the prior art, the embodiment of the present invention uses the Capability mechanism to authorize probes, which not only enables the probes to have complete security monitoring capabilities, but also ensures that the stability of the business load and the security of the probes themselves are not affected.

[0055] As an optional implementation manner, the detection behavior database stores the attacker's attack method, common search engine ranking method and malicious IP address.

[0056] It is worth noting that before monitoring the attacker's reconnaissance behavior, the embodiment of the present invention also pre-sorts the attacker's attack methods and builds a reconnaissance behavior database based on the attacker's attack methods, common search engine ranking methods, and malicious IP (Internet Protocol) addresses, where "common search engines" refer to search engines whose frequency of appearance exceeds a preset threshold. By building a reconnaissance behavior database, the embodiment of the present invention can improve the accuracy and efficiency of monitoring.

[0057] Compared with the prior art, the embodiment of the present invention is based on a pre-built reconnaissance behavior database and uses non-root permission probes to monitor attackers' port scanning, vulnerability detection, brute force behavior and other reconnaissance activities. It can achieve full-port threat perception and timely capture the attacker's initial behavior, thereby improving network security protection effects.

[0058] As one optional implementation manner, it is characterized in that after the virtual subnet is constructed, the method further includes:

[0059] Obtaining traffic information of the real network through a traffic monitoring tool;

[0060] When non-standard port communication or abnormal file transfer appears in the traffic information, the corresponding subject is identified as a malicious script, and the malicious script is redirected to the virtual subnet.

[0061] It is worth noting that when identifying attackers, a combination of multiple identification methods can be used, such as a combination of log analysis and traffic analysis. In the embodiment of the present invention, the traffic information is also deeply analyzed, and when the behavior characteristics of the Webshell are identified from the traffic information (such as non-standard port communication and abnormal file transfer, etc.), the suspicious Webshell activity is redirected to the mimic environment.

[0062] As an optional implementation manner, after the virtual subnet is constructed, the method further includes:

[0063] Regularly collect basic information of the real host;

[0064] When the basic information is changed, the virtual subnet is updated based on the changed basic information.

[0065] It is understandable that the role of the mimicry system is to confuse attacks, that is, to mislead attackers into judging the real network, so as to hide the structure and services of the real network. Therefore, in order to prevent attackers from identifying the virtual environment, the mimicry system needs to be close enough to the real network, that is, it needs to maintain high simulation. Therefore, in some embodiments of the present invention, the basic information of the real host is also collected regularly, and after the basic information of the real host changes, the virtual subnet is updated accordingly to ensure that the virtual system can synchronize the changes of the real host environment.

[0066] As an optional implementation manner, after the virtual subnet is constructed, the method further includes:

[0067] Enter illegal command script;

[0068] Acquire actual response data of the virtual subnet to the illegal command script and new system data of the real host;

[0069] When the system data is tampered with, or when the actual response data is different from the expected response data, the configuration and policy of the virtual subnet are modified; wherein the expected response data is the response data of the real network after the illegal command script is input.

[0070] It is worth noting that in some embodiments of the present invention, after the mimic system is constructed, the performance of the mimic system needs to be tested, including whether the mimic system can respond correctly to the attack of malicious scripts, and whether the system data of the real host can be ensured not to be tampered with under the isolation of the mimic system, that is, when the response of the mimic system to the illegal command script is the same as the response of the real network to the illegal command script, and the intrusion of the illegal command script only tampers with the system data of the mimic system, but does not tamper with the system data of the real host, it is considered that the configuration of the mimic system meets the requirements and can be put into use. Otherwise, it is necessary to reset the configuration and policy of the mimic system and retest until the requirements are met. Among them, the illegal command script can be an attack method such as file upload and command execution.

[0071] Exemplarily, in some embodiments, since there are multiple combinations of configuration methods and strategies of the mimetic system, different configuration methods, strategies and corresponding network security protection effects (response data of the mimetic system, whether the system data of the mimetic system and the real host have been tampered with) can be collected and used as training data to train a deep learning model, so as to predict the network security protection effects of the mimetic system under different configurations and strategies through the trained deep learning, which can be used to assist in selecting the most appropriate mimetic system configuration and strategy.

[0072] As an optional implementation manner, the number of the virtual sentinel nodes is more than 8 times the number of nodes in the real network.

[0073] It is worth noting that in step S3, the virtual sentinel node, that is, the node of the virtual subnet, can be a lightweight virtual machine or container, and the embodiment of the present invention also uses micro-isolation technology to perform fine-grained access control on the virtual sentinel node, ensuring that only authorized traffic can pass through the virtual subnet, while monitoring east-west traffic in real time, and alarming and recording abnormal traffic for subsequent analysis.

[0074] Furthermore, the number of virtual sentinel nodes is greater than the number of nodes in the real network. In some embodiments, the number of virtual sentinel nodes is much greater than the number of nodes in the real network, for example, the number of virtual sentinel nodes is more than 8 times the number of nodes in the real network. Compared with the prior art, the embodiment of the present invention can form an insurmountable barrier through the advantage of number to isolate attackers from the real network and improve the network security protection effect by setting the number of virtual sentinel nodes much greater than the number of nodes in the real network.

[0075] Compared with the prior art, the network security protection method based on the simulated environment provided by the embodiment of the present invention inputs the basic information of the real host, and the basic information includes the protocol, host architecture and registry information; according to the basic information, a virtual host is simulated on the virtualization platform; a virtual sentinel node is set based on each of the virtual hosts, and a virtual subnet is constructed based on the virtual sentinel nodes; wherein the number of the virtual sentinel nodes is greater than the number of nodes in the real network; based on a pre-built reconnaissance behavior database, a non-root permission probe is used to monitor the reconnaissance behavior of the nodes of the real network; when the reconnaissance behavior is monitored, the corresponding node is used as a potential risk node, and the log file of the potential risk node is retrieved; the log file is matched with a pre-built cloud threat database for keywords, and when the number of matched keywords is greater than a first preset number, the corresponding subject is identified as a malicious script, and the malicious script is redirected to the virtual subnet. The embodiment of the present invention can capture the initial activities of attackers by using non-root permission probes to monitor the reconnaissance behavior, so as to monitor the potential risk nodes in advance, and after identifying the malicious scripts, it also directs them to the pre-built virtual subnet to protect the real host, thereby greatly improving the timeliness and protection effect of network security protection.

[0076] See also Figure 2 The embodiment of the present invention further provides a network security protection device 10 based on a pseudo-environment, comprising:

[0077] The host information acquisition module 11 is used to input the basic information of the real host, which includes the protocol, host architecture and registry information;

[0078] A virtual host simulation module 12, used to simulate a virtual host on a virtualization platform according to the basic information;

[0079] A virtual environment construction module 13, used to set a virtual sentinel node based on each virtual host, and to construct a virtual subnet based on the virtual sentinel node; wherein the number of the virtual sentinel nodes is greater than the number of nodes in the real network;

[0080] A detection behavior monitoring module 14 is used to monitor the detection behavior of the nodes of the real network using a non-root permission probe based on a pre-built detection behavior database;

[0081] The risk node monitoring module 15 is used to, when monitoring the detection behavior, identify the corresponding node as a potential risk node and retrieve the log file of the potential risk node;

[0082] The diversion module 16 is used to match the log file with a pre-built cloud threat database by keywords. When the number of matched keywords is greater than a first preset number, the corresponding subject is identified as a malicious script and the malicious script is redirected to the virtual subnet.

[0083] The network security protection device based on the pseudo-environment provided in the embodiment of the present invention can implement all the process steps of the network security protection method based on the pseudo-environment described in the above embodiment. The functions of each module and unit in the device and the technical effects achieved are respectively the same as the functions and technical effects achieved by the network security protection method based on the pseudo-environment described in the above embodiment. The specific implementation method will not be repeated here.

[0084] See also Figure 3 The embodiment of the present invention further provides a network security protection device 20 based on a pseudo-environment, comprising a processor 21, a memory 22, and a computer program stored in the memory 22 and configured to be executed by the processor 21. When the processor 21 executes the computer program, the steps in the embodiment of the network security protection method based on the pseudo-environment are implemented, for example Figure 1 or, the processor 21 implements the functions of each module in the above-mentioned device embodiments when executing the computer program.

[0085] The network security protection device based on the mimic environment can be a computing device such as a desktop computer, a notebook, a PDA, and a cloud server. The network security protection device based on the mimic environment can include, but is not limited to, a processor and a memory. Those skilled in the art can understand that the schematic diagram is only an example of a network security protection device based on a mimic environment, and does not constitute a limitation on the network security protection device based on the mimic environment. It can include more or fewer components than shown in the figure, or combine certain components, or different components. For example, the network security protection device based on the mimic environment can also include input and output devices, network access devices, buses, etc.

[0086] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the network security protection device based on the mimic environment, and uses various interfaces and lines to connect the various parts of the entire network security protection device based on the mimic environment.

[0087] The memory can be used to store the computer program and / or module, and the processor realizes various functions of the network security protection device based on the mimic environment by running or executing the computer program and / or module stored in the memory, and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function, etc.; the data storage area can store data created according to the use of the controller, etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0088] Wherein, if the module integrated by the network security protection device based on the pseudo environment is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Wherein, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium, etc.

[0089] Compared with the prior art, the network security protection device, equipment and medium based on the simulated environment provided by the embodiments of the present invention input the basic information of the real host, and the basic information includes the protocol, host architecture and registry information; according to the basic information, a virtual host is simulated on the virtualization platform; a virtual sentinel node is set based on each of the virtual hosts, and a virtual subnet is constructed based on the virtual sentinel nodes; wherein the number of the virtual sentinel nodes is greater than the number of nodes in the real network; based on a pre-constructed reconnaissance behavior database, a non-root permission probe is used to monitor the nodes of the real network for reconnaissance behavior; when the reconnaissance behavior is monitored, the corresponding node is used as a potential risk node, and the log file of the potential risk node is retrieved; the log file is matched with a pre-constructed cloud threat database for keywords, and when the number of matched keywords is greater than a first preset number, the corresponding subject is identified as a malicious script, and the malicious script is redirected to the virtual subnet. The embodiment of the present invention can capture the initial activities of attackers by using non-root permission probes to monitor the reconnaissance behavior, so as to monitor the potential risk nodes in advance, and after identifying the malicious scripts, it also directs them to the pre-built virtual subnet to protect the real host, thereby greatly improving the timeliness and protection effect of network security protection.

[0090] The above is a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several improvements and modifications without departing from the principle of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A network security protection method based on a pseudo-environment, characterized in that: include: Enter basic information of the real host, including protocol, host architecture and registry information; According to the basic information, a virtual host is simulated on a virtualization platform; Setting a virtual sentinel node based on each of the virtual hosts, and constructing a virtual subnet based on the virtual sentinel nodes; wherein the number of the virtual sentinel nodes is greater than the number of nodes in the real network; Based on a pre-built reconnaissance behavior database, a non-root permission probe is used to monitor the reconnaissance behavior of the nodes of the real network; When the detection behavior is monitored, the corresponding node is regarded as a potential risk node, and the log file of the potential risk node is retrieved; The log file is matched with a pre-built cloud threat database by keywords, and when the number of matched keywords is greater than a first preset number, the corresponding subject is identified as a malicious script, and the malicious script is redirected to the virtual subnet.

2. The network security protection method based on the pseudo-environment according to claim 1, characterized in that: The non-root permission probe is installed on the real network, and the non-root permission probe is authorized using a Capability mechanism; and the detection behavior includes at least one of port scanning, vulnerability detection, and brute force behavior.

3. The network security protection method based on the pseudo-environment according to claim 1, characterized in that: The detection behavior database stores the attacker's attack methods, common search engine ranking methods and malicious IP addresses.

4. The network security protection method based on the pseudo-environment according to claim 1, characterized in that: After the virtual subnet is constructed, the following steps are also included: Obtaining traffic information of the real network through a traffic monitoring tool; When non-standard port communication or abnormal file transfer appears in the traffic information, the corresponding subject is identified as a malicious script, and the malicious script is redirected to the virtual subnet.

5. The network security protection method based on the pseudo-environment according to claim 1, characterized in that: After the virtual subnet is constructed, the following steps are also included: Regularly collect basic information of the real host; When the basic information is changed, the virtual subnet is updated based on the changed basic information.

6. The network security protection method based on the pseudo-environment according to claim 1, characterized in that: After the virtual subnet is constructed, the following steps are also included: Enter illegal command script; Acquire actual response data of the virtual subnet to the illegal command script and new system data of the real host; When the system data is tampered with, or when the actual response data is different from the expected response data, the configuration and policy of the virtual subnet are modified; wherein the expected response data is the response data of the real network after the illegal command script is input.

7. The network security protection method based on the pseudo-environment according to claim 1, characterized in that: The number of the virtual sentinel nodes is more than 8 times the number of nodes in the real network.

8. A network security protection device based on a pseudo-environment, characterized in that: include: A host information acquisition module is used to input basic information of the real host, the basic information including protocol, host architecture and registry information; A virtual host simulation module, used to simulate a virtual host on a virtualization platform according to the basic information; A pseudo-environment construction module, used to set up virtual sentinel nodes based on each of the virtual hosts, and to construct a virtual subnet based on the virtual sentinel nodes; wherein the number of the virtual sentinel nodes is greater than the number of nodes in the real network; A detection behavior monitoring module is used to monitor the detection behavior of the nodes of the real network using a non-root permission probe based on a pre-built detection behavior database; A risk node monitoring module is used to, when monitoring the detection behavior, identify the corresponding node as a potential risk node and retrieve the log file of the potential risk node; The traffic diversion module is used to match the log file with a pre-built cloud threat database by keywords. When the number of matched keywords is greater than a first preset number, the corresponding subject is identified as a malicious script and the malicious script is redirected to the virtual subnet.

9. A network security protection device based on a mimic environment, characterized in that: The invention comprises a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, the network security protection method based on the simulated environment as described in any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located is controlled to execute the network security protection method based on a simulated environment as described in any one of claims 1 to 7.

Images