Dynamic attack surface transformation active defense system for production system

Abstract

The invention discloses a dynamic attack surface transformation active defense system for a production system, and relates to the field of network security, the active defense system comprises a system support module, an interface interpreter module, a moving target construction module, a dynamic arrangement module, a management module, an information processing module and a threat monitoring module; the system support module provides network service, file system and user account camouflage functions and converts the functions into standard interfaces through the interface interpreter module to be called by the upper layer module, and the moving target construction module interacts with the system support module through an interface interpreter and supports dynamic arrangement of camouflage resources. The dynamic arrangement module adjusts attack surface features of system resources according to real-time threat information provided by the threat monitoring module, when the threat monitoring module finds potential attacks, threat information is transmitted to the management module, the dynamic arrangement module is triggered to carry out adjustment, and the information processing module records logs and displays system states and threat alarms. And administrators are assisted to make decisions.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a dynamic attack surface transformation active defense system for a production system. Background Art

[0002] With the rapid development of information technology, network security issues are becoming increasingly serious, especially in key areas such as industrial control systems and production systems. Network security protection has become an urgent problem to be solved. Existing network security defense technologies mainly rely on traditional passive defense methods such as firewalls, intrusion detection systems, and virus scanning. However, these traditional defense technologies often have many limitations and cannot effectively respond to increasingly complex and changeable network attacks.

[0003] Traditional network defense technology relies on static feature libraries and rule libraries for attack identification. Defense measures are usually initiated only after an attack occurs. Attackers can first penetrate the system, conduct reconnaissance and exploit vulnerabilities, and defense systems are often unable to effectively prevent attacks before they occur. Feature-based defense relies on regularly updating feature libraries, which makes it impossible for the system to identify new attack methods in a timely manner, especially zero-day attacks and variant attacks.

[0004] Mobile target defense (MTD) is an active network defense technology. The core idea is to bring asymmetric advantages to defenders by randomizing, diversifying and redundancies the characteristics of protected networks and systems in different dimensions, creating a dynamic attack surface that is difficult for attackers to identify and exploit, and achieving unpredictability of system configuration changes, thereby hindering attack reconnaissance and exploitation attempts. Deceptive defense technology focuses on camouflage and obfuscation, misleading error responses, and the use of other techniques to distract attackers from legitimate targets and lure them into decoys and other bait systems, thereby increasing the complexity and cost of attacks; but it has the following defects:

[0005] 1) Network address change technology is one of the mainstream implementation technologies in mobile target defense technology. With the network address as the mobile parameter, changing the address can make the address of the message in the network change randomly over time, thereby confusing the attacker. Even if the message is intercepted, its address information is only valid for a short period of time. Deploying the mobile target defense method with randomized address in the production system may cause a large overhead to the real system, is complex to implement, and may affect the normal business services in the production system.

[0006] 2) Existing defense deception technologies, such as honeypots, honeynets, and honey bait systems, are usually deployed independently in production systems. They construct separate, fake nodes that are separated from the production system and virtualize real system functions and business services on them. They are not effectively integrated with the production system and are easily identified and bypassed by attackers. Summary of the invention

[0007] The purpose of the present invention is to provide a dynamic attack surface transformation active defense system that combines mobile target defense and network deception technology, which can dynamically adjust the attack surface, confuse attackers and improve the security of the system without affecting the normal business of the production system.

[0008] The technical solution of the present invention is: providing a dynamic attack surface transformation active defense system for a production system, the active defense system comprising: a system support module, an interface interpreter module, a mobile target construction module, a dynamic orchestration module, a management module, an information processing module, and a threat monitoring module;

[0009] The system support module provides false and disguised functions for network services, file systems, and user account resources. The system support module encapsulates the underlying disguised resources through the interface interpreter module and converts them into standard interfaces that can be called by upper-level modules. The programming languages ​​of the system support module and the mobile target building module are different. The interface interpreter module opens up the interface standards between the programming languages ​​of the system support module and the mobile target building module. The mobile target building module interacts with the system support module through the interface interpreter, supports the upper-level dynamic orchestration module to adjust the attack surface characteristics, and performs network service disguise, file system disguise, and user account disguise, which increases the difficulty for attackers to identify and exploit vulnerabilities.

[0010] When the threat monitoring module finds a potential attack, it passes the relevant threat information to the dynamic orchestration module through the management module. The dynamic orchestration module triggers the dynamic orchestration and change of the underlying disguised resources of network services, file systems, and user accounts according to the threat information, so as to adjust the attack surface characteristics.

[0011] At the same time, the information processing module records the system's operation logs and displays the system status and threat alerts in real time, providing them to administrators for decision-making.

[0012] In any of the above technical solutions, further, the system support module includes a network component, a file system component, a user environment component and a log component, which respectively provide network camouflage services, file system camouflage, user environment camouflage and operation log recording functions.

[0013] In any of the above technical solutions, further, the interfaces provided by the interface interpreter module include: a network service interface for dynamically configuring disguised services and listening ports; a file system interface for configuring disguised files and access monitoring; and a user environment interface for configuring disguised user accounts and dynamic user environments.

[0014] In any of the above technical solutions, further, the dynamic orchestration module abstracts the states of resources such as network services, file systems, and user accounts in the system into attack surface feature vectors based on finite state machine theory, and adjusts the states of various resources through an event-driven mechanism.

[0015] In any of the above technical solutions, further, the dynamic orchestration module adjusts the configuration of system resources according to the threat information fed back by the threat monitoring module, and the adjustment content includes: dynamically changing the configuration of the disguised service; randomizing the file name, permissions and access path of the file system; dynamically adjusting the root directory and environment configuration of the disguised user account.

[0016] In any of the above technical solutions, further, the active defense system further includes: a security deployment module; the security deployment module implements isolation between the defense system and the production system through a multi-layer sandbox isolation architecture, specifically including:

[0017] First layer of isolation: The process of the active defense system is isolated from the normal production system process through container technology. The permissions of the container are finely configured and limited to the permissions actually required by the system, avoiding direct interaction between the defense system and the production system.

[0018] Second layer of isolation: Control access to the production system kernel through whitelist technology to ensure that only authorized processes can access production system resources;

[0019] The third layer of isolation: Through mandatory access control policies, the interaction between the active defense system and the production system is limited to prevent the defense system from accessing unnecessary objects.

[0020] In any of the above technical solutions, further, the dynamic orchestration module dynamically adjusts the attack surface characteristics at different time points in an event-driven manner, including:

[0021] At time t1, the production node configures disguised Bind DNS, HTTP server, Samba, FTP, and ApacheTomcat network services to confuse attackers, and records all IP addresses that access the service;

[0022] At time t2, the production node configures SSH, Bind DNS, Rpcbind, and Mysql network services to redirect all access requests to a specific port. At the same time, the production node configures the Fakefile0 disguised file and monitors external access records to the disguised file.

[0023] At time t3, the production node reconfigures Bind DNS, HTTP server, and Samba to build a fake file Fakefile1. The system denies all access to the fake file Fakefile1 and locks out users who attempt to access the fake file Fakefile1. The production node reconfigures FTP, Bind DNS, Samba, and Apache Tomcat to build a fake file Fakefile2. The system records all IPs that access the fake file Fakefile2 and transparently filters access requests from the recorded IPs in the global system.

[0024] A method for active defense of dynamic attack surface transformation for a production system is also provided, and the method for active defense is applied to any of the above-mentioned active defense systems for dynamic attack surface transformation for a production system.

[0025] The beneficial effects of the present invention are:

[0026] The technical solution of the present invention combines mobile target defense technology with network deception technology to dynamically adjust the attack surface of the production system, which can not only effectively confuse attackers and increase the difficulty of their attacks, but also avoid interference with the production environment and waste of resources, thereby improving system security while ensuring the stability and efficiency of the production system.

[0027] In addition, the defense system of the present invention adopts a lightweight deployment method, avoiding the excessive burden of traditional defense technologies on the production system, and can respond to potential threats in real time, providing stronger active defense capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] The advantages of the above and additional aspects of the present invention will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0029] Figure 1 is a schematic diagram of a framework of a dynamic attack surface transformation active defense system for a production system according to an embodiment of the present invention;

[0030] Figure 2 The diagram is a schematic diagram of dynamic attack surface transformation of a dynamic attack surface transformation active defense system for a production system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0031] In order to more clearly understand the above-mentioned purpose, features and advantages of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be noted that the embodiments of the present invention and the features in the embodiments can be combined with each other without conflict.

[0032] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Therefore, the protection scope of the present invention is not limited to the specific embodiments disclosed below.

[0033] like Figure 1 and Figure 2 As shown, this embodiment provides a dynamic attack surface transformation active defense system for production systems, which provides an integrated active defense solution by combining mobile target defense technology with network deception technology; the system can implement disguised and dynamically changing network services, file systems, user accounts and other resources on real nodes of the production system, thereby dynamically changing the attack surface, confusing attackers and improving the security of the system.

[0034] The active defense system includes: a system support module, an interface interpreter module, a mobile target construction module, a dynamic orchestration module, a management module, an information processing module, a threat monitoring module and a security deployment module.

[0035] The above modules work together to protect the security of the production system through precise collaboration: the system support module provides basic resources and support for other modules, including false and disguised functions of network services, file systems and user account resources. The system support module encapsulates the underlying disguised resources through the interface interpreter module and converts them into standard interfaces that can be called by upper-level modules; the programming languages ​​of the system support module and the mobile target construction module are different: the underlying disguised resources provided by the system support module are closer to the underlying implementation of the operating system, so its programming language is generally C or C++, and the mobile target construction module is closer to the user operation application level and is usually implemented in Python; the interface interpreter module opens up the interface standards between the programming languages ​​of the system support module and the mobile target construction module; the mobile target construction module interacts with the system support module through the interface interpreter, supports the upper-level dynamic orchestration module to adjust the attack surface characteristics, performs network service disguise, file system disguise and user account disguise, and increases the difficulty for attackers to identify and exploit vulnerabilities.

[0036] When the threat monitoring module detects a potential attack, it passes the relevant threat information to the dynamic orchestration module through the management module. The dynamic orchestration module triggers dynamic orchestration and changes to the underlying camouflage resources of network services, file systems, and user accounts based on the threat information, thereby adjusting the attack surface characteristics.

[0037] At the same time, the information processing module helps administrators to timely understand the security situation of the system and the activities of each module by displaying the system status, storing logs and processing alarms. The information processing module not only displays the changes in the attack surface from the dynamic orchestration module, but also processes security alarms from the threat monitoring module, providing administrators with a comprehensive defense view.

[0038] Through this collaborative work, the various modules in the system form a multi-level defense system, ensuring that the system can respond and make adjustments in a timely manner when any potential attack occurs, thereby effectively protecting the production system from external threats.

[0039] Specifically, the system support module is the basic support part of the defense system, responsible for providing basic functions in multiple aspects, including technical support in network, file system, user environment and log, to ensure that the system can run efficiently and securely, and can support upper-level modules (such as mobile target construction module, dynamic orchestration module, etc.) for camouflage and dynamic changes.

[0040] Network component: By simulating real network services and making these services present different characteristics at different times, it confuses attackers and increases the difficulty of their attacks. The network component supports camouflaging specified network services. By camouflaging common network services (such as HTTP, DNS, FTP, etc.) on open ports, the system can make attackers think that these services are real targets in the system, but in fact they are just baits without real service content. Based on the camouflaged service, the network component can also dynamically generate the signature of the camouflaged service, that is, the seemingly valid false response information obtained by the attacker when probing the service characteristics, thereby increasing the difficulty of the attacker's reconnaissance. The camouflaged service can change at any time, making it impossible for the attacker to determine the true status of the camouflaged service through information such as signatures. The network component supports monitoring a set of predefined ports, which may be ports of real business or ports of camouflaged services. When the attacker tries to access through these ports, the network component will dynamically monitor and respond to these requests, thereby guiding the attacker to the false target. The network component can also dynamically adjust the monitored ports according to the security requirements of the system; it can adjust which ports are open to the outside world at different time periods to further confuse attackers.

[0041] File system component: By simulating the structure of a real file system, it is difficult for attackers to distinguish which files are actually there and which are just baits. The file system component can create disguised files or directories in the production system. These disguised files look very similar to the files in the real system, and can even have the same file name, directory structure and permission settings, so that attackers think they have obtained real file access rights. The file system component can attach listeners to disguised files and real files. Whenever an attacker accesses these files, the system will monitor and record the attacker's behavior in real time. The file system component can also perform integrity checks on real files to ensure that the files have not been accessed or tampered with without authorization. In this way, the system can promptly detect whether an attacker is trying to penetrate the file system and obtain sensitive data. For real files and directories, the file system component can monitor whether abnormal operations have occurred. For example, the system can record which users or processes have accessed which files and check whether there are unauthorized operations. If it is detected that an attacker is exploiting certain file vulnerabilities, the system can take measures, such as terminating the attacker's operations or locking their access rights.

[0042] User environment component: simulates user accounts and user environments, so that even if attackers obtain certain user permissions, they cannot actually enter the core area of ​​the production system. This component confuses attackers by providing disguised user accounts and dynamically configured user environments. The user environment component can create a large number of disguised user accounts in the system. Each disguised account has certain characteristics of real users, such as user name, password, UID (user ID), user root directory, etc. Attackers may obtain the permissions of disguised accounts through some means and think that they have successfully penetrated the system, but in fact these accounts do not have actual permissions to access the production system; the user environment component also configures user root directories, initial environment configurations and other information for disguised user accounts. By simulating a normal user environment, attackers may think that they have obtained valid user permissions. It can even edit files, run programs, etc. However, the purpose of these operations is only to disguise the environment and cannot pose any threat to the production system. In order to further confuse attackers, the user environment component also provides a highly interactive pseudo-shell service. When an attacker successfully logs in through an account, the system will provide a pseudo-shell environment. This environment looks the same as the real user shell, but it is actually just simulating the attacker's operations. In this way, the attacker cannot really access sensitive data or key applications in the production system. The user environment component can dynamically adjust the configuration of the disguised user account. For example, the system can modify the password or root directory path of the disguised account at different time periods to further increase the attacker's confusion. In this way, attackers cannot obtain continuous access rights through fixed configurations.

[0043] Log component: records and processes all kinds of operation and event logs in the system. Through standardized processing and analysis of logs, the log component can help the system detect abnormal behavior and issue alarms in a timely manner, and can also provide a basis for subsequent security analysis. The log component records the operations of all system support modules, including access to disguised services, disguised files, and disguised user accounts. Through detailed log records, the system can track the attacker's behavior trajectory and help administrators analyze the attack method; when the attacker performs certain malicious operations, the log component can trigger an alarm and notify the system administrator in time. The log component standardizes all log information and stores it in a structured database. Administrators can query and analyze these log data as needed to extract potential security threat information from them; the log component also has certain analysis functions, which can automatically identify potential security events and abnormal behavior patterns. Through the analysis of log data, the system can discover the behavior of the attacker bypassing the defense and adjust the defense strategy to deal with new threats.

[0044] The main task of the interface interpreter module is to standardize and unify the functions provided by the system support module. It converts the management capabilities of various underlying resources (such as network, file system, user environment) into a unified interface for the upper-level modules to call. This module provides a set of standardized API interfaces to ensure the coordination between different modules.

[0045] The interfaces provided by the interface interpreter module include:

[0046] Network service interface, used to dynamically configure masquerade services and listening ports.

[0047] File system interface for configuring disguised files and access monitoring.

[0048] User environment interface, used to configure fake user accounts and dynamic user environments.

[0049] The function of the mobile target building module is to interact with the system support module through the interface interpreter, build and support dynamic orchestration of disguised network services, disguised file systems and disguised user accounts, and enhance the system's defense capabilities; the mobile target building module includes network service components, file system components and user account components.

[0050] Network service component: This component supports the function of camouflaging services. It can camouflage any service on the selected open port and respond to the detection of these services through dynamically generated signatures. The purpose of camouflaging services is to make it impossible for attackers to confirm which services are real, thereby prolonging the attack reconnaissance phase. In addition, the network service component also provides a monitoring service function. It will monitor predefined ports in real time and can dynamically adjust the monitoring ports. It supports multiple port configurations including real business service ports and camouflaged service ports.

[0051] File system component: The main function of the file system component is to provide file system disguise and dynamic orchestration support; it supports the creation of disguised files and attaches listeners to all disguised files to detect whether anyone has accessed these files. Once abnormal file access is detected, it can trigger an alarm and take countermeasures; in addition, the file system component also supports monitoring the access to real files and directories in the production system and records all operations. In this way, potential security risks can be discovered and responded to in a timely manner in the production system.

[0052] User Account Component: The User Account Component is responsible for building fake user accounts in the production system and providing a dynamic and interactive environment for these fake accounts. For example, it can simulate a highly interactive pseudo-shell service, making the attacker believe that they have obtained the permissions of the real user and start to operate the real file system. However, in fact, the attacker is still in a fake environment and cannot really harm the production system.

[0053] The dynamic orchestration module is responsible for dynamically transforming the attack surface characteristics in an event-driven manner. Through the finite state machine theory, this module constructs an attack surface state transformation model based on resources such as network services, file systems, and user accounts in the system. In this model, the attack surface feature vector is composed of the states of multiple system resources, and the characteristics of each resource determine the security state faced by the current system. Through rule configuration and feedback from threat events, the dynamic orchestration module can adjust the configuration of various resources, thereby changing the attack surface seen by attackers.

[0054] The design of the dynamic orchestration module is based on the finite state machine theory. It abstracts the system state at each moment into an attack surface feature vector. This vector is composed of the characteristics of multiple system resources (such as network services, file systems, user accounts, etc.) at that moment. The characteristics of each resource (such as port, protocol, file name, user account information, etc.) determine the security status of the resource.

[0055] Under the attack surface feature vector model, the attack surface of the system is presented as a set of states; each state represents the characteristic configuration of the system at a certain moment, and the state of each resource is affected by external threat events; through linkage with the threat monitoring module, the system can update the attack surface state and change the security layout of the system according to real-time threat events.

[0056] The change of the attack surface state is triggered by the threat monitoring module; when the threat monitoring module finds a potential security threat, it will pass the threat information to the dynamic orchestration module, and the dynamic orchestration module will adjust the state of each resource in the system based on this information. For example, it may close certain ports or switch camouflage services, thereby changing the attack surface so that the attacker sees different attack surface features at different times.

[0057] This dynamic change process is achieved through "rule configuration". Administrators can configure different rules based on different threat events to instruct the system how to adjust the characteristics of network services, file systems, and user accounts, thereby achieving changes in the attack surface status.

[0058] Each attack surface feature vector is composed of the status of multiple resources. The following are several common resource types in the system and their feature composition:

[0059] Network service characteristics: including service name, protocol type, open ports, etc.

[0060] File system characteristics: including file name, file permissions, file path, file owner, etc.

[0061] User account characteristics: including user name, password, UID (user ID), user root directory, etc.

[0062] These resource characteristics together constitute the attack surface state at a moment. The task of the dynamic orchestration module is to adjust these characteristics according to different threat events, so that the "attack surface" seen by the attacker is always changing, thereby increasing the difficulty of his attack.

[0063] To better demonstrate how the dynamic orchestration module works, the following example illustrates how the attack surface status changes at different time points.

[0064] Table 1 Attack surface characteristics at time t1, t2, and t3

[0065]

[0066]

[0067] At time t1, production node 1 exposes DNS, HTTP, and Samba services, and all IPs accessing these services will be recorded; production node 2 exposes FTP, DNS, Samba, and Apache Tomcat services, and provides false interactions for these services, making it impossible for attackers to confirm which services are real.

[0068] At time t2, production node 1 exposes SSH, DNS, Rpcbind and MySQL services. All requests to access these services will be redirected to a specific port. Production node 2 exposes the DNS service and introduces a fake file named "Fakefile0". All access to Fakefile0 will be recorded and trigger an alarm.

[0069] At time t3, production node 1 exposes DNS, HTTP, and Samba services, and introduces the Fakefile1 disguised file. All access to Fakefile1 will be denied, and users who operate the file will be locked. Production node 2 exposes FTP, DNS, Samba, and Apache Tomcat services, and introduces the Fakefile2 disguised file. All IPs that have accessed Fakefile2 will be transparently filtered when accessing the real service, thereby preventing attackers from continuing to infiltrate.

[0070] In actual applications, the workflow of the dynamic orchestration module is as follows:

[0071] Monitoring threat events: The threat monitoring module monitors potential threat events inside and outside the system in real time, such as abnormal logins, network scanning, vulnerability exploits, etc.

[0072] Adjust rule configuration: When the threat monitoring module detects a potential threat, the dynamic orchestration module will adjust the characteristics of network services, file systems, and user accounts according to the preset rule configuration. For example, it can close certain ports, hide real services, and start new disguised services.

[0073] Update attack surface characteristics: According to the new rule configuration, the attack surface feature vector changes, and the attack surface becomes unpredictable. Attackers cannot predict the attack surface they will face next, which increases the difficulty of their attacks.

[0074] Feedback and learning: The system continuously learns and accumulates the behavior patterns of attackers, and adjusts the attack surface configuration according to the attacker's actions to maximize the defense effect.

[0075] The management module is the centralized management and configuration module of the system, providing the use, deployment, maintenance and management functions of the entire defense system; it realizes the following key functions through collaboration with other modules:

[0076] Remote deployment: The management module is responsible for remotely deploying components such as the system support module, interface interpreter module, mobile target building module, and dynamic orchestration module to the production system nodes.

[0077] Threat alarm: When the threat monitoring module triggers a threat alarm, the management module can receive the alarm information in real time and adjust the system configuration or initiate emergency response measures according to the security administrator's operational requirements.

[0078] Dynamic orchestration and manual intervention: The management module provides manual intervention capabilities, allowing security managers to directly modify orchestration rules or reset system configurations after real-time threat events occur.

[0079] The information processing module is mainly responsible for processing and displaying various status information, operation logs and threat alerts in the system. This module stores the logs from the system support module in a structured manner, generates external reports, and supports the threat monitoring module in making automated decisions on security incidents. At the same time, it also provides security operations personnel with analysis, assessment and decision-making support for security incidents.

[0080] The threat monitoring module regularly processes the data in the information processing module and generates alerts about the potential threats detected; the threat monitoring module will send real-time threat event alerts to the management module, and security managers can modify and reset the configuration according to the event-driven attack surface transfer change strategy. In addition, the threat monitoring module can also work with the existing security equipment of the production system to eliminate potential risks in the system in a timely manner.

[0081] In order to ensure the security of the defense system itself, the security deployment module adopts a multi-layer sandbox isolation architecture to limit access to the production system. Specific deployment measures include:

[0082] The first layer of isolation: The process of the active defense system is isolated from the normal production system process through container technology. The permissions of the container are finely configured and limited to the permissions actually required by the system, avoiding direct interaction between the defense system and the production system.

[0083] Second layer of isolation: Control access to the production system kernel through whitelist technology to ensure that only authorized processes can access system resources.

[0084] The third layer of isolation: Through mandatory access control policies, the interaction between the defense system and the production system is limited to prevent the active defense system from accessing unnecessary objects.

[0085] This multi-layer isolation architecture makes it difficult for attackers to break into the production system through container vulnerabilities even if they can break through the defense system, further improving the security of the overall system.

[0086] In another embodiment of the present invention, the active defense system proposed by the present invention is configured on a test server to simulate external attacks and verify the reliability of the active defense system:

[0087] The test server is equipped with a production control system (PCS) and a manufacturing execution system (MES). During the production process, it is necessary to ensure the security of the network and data to prevent attackers from infiltrating the network and affecting the operation of the production line.

[0088] The system support module provides the underlying camouflage resources to the mobile target building module, which deploys the following camouflage resources in the nodes of the production control system and the manufacturing execution system:

[0089] Disguised network services: including HTTP, FTP, DNS and database (MySQL) services.

[0090] Disguised file system: Multiple fake file directories and files were created, such as "Production Schedule.xlsx" and "Confidential Data.csv".

[0091] Fake user accounts: Added multiple real-looking but invalid user accounts, such as user_admin and guest_operator.

[0092] The dynamic orchestration module dynamically adjusts the attack surface of the production system to the state at different time points. The state at each moment is determined by the configuration of network services, file systems, and user accounts. The orchestration rules set this time are as follows:

[0093] Time t1: The core node exposes the disguised network service, and the system records the visitor's behavior.

[0094] Time t2: Provide a disguised file to induce the attacker to access and record the access path.

[0095] Time t3: Close access to sensitive files and directly lock out users who attempt to access them illegally.

[0096] The system exposed disguised services: Bind DNS-53 for DNS query, HTTP server-80 for providing a fake production status monitoring page, and Samba-139,445 for sharing disguised content files. After simulating external attacks, the attacker discovered the above services through network scanning tools and tried to use brute force tools to brute-force login to the HTTP service and access certain shared files in the disguised file system.

[0097] The dynamic orchestration module continuously monitors the access behavior of the above services and records the access IP in the log. For example, the dynamic orchestration module detects an abnormal request from the attacker with IP 192.168.1.101. The main characteristics of this request include: multiple attempts to log in to the disguised HTTP service (triggering a large number of failed POST requests in a short period of time) and attempts to read the disguised file "Production Schedule.xlsx". The dynamic orchestration module records the IP 192.168.1.101 in the log.

[0098] The threat monitoring module determines that the abnormal request detected by the dynamic orchestration module has malicious characteristics, generates a threat event alarm and pushes it to the management module. The threat event alarm includes the attacker's behavior characteristics and IP address.

[0099] After receiving the threat event alert, the management module sends a control instruction to the dynamic orchestration module, shuts down the originally exposed HTTP server-80 service, opens SSH-22 and Rpcbind-111, redirects all access to the disguised service, simulates the real login page in the new disguised service, and records all login attempts.

[0100] The dynamic orchestration module exposes a new disguised file Fakefile0 (file name "financial data.csv") to the attacker. When the attacker tries to access this file, the system will capture the access path, access tool and related behavior data.

[0101] Simulating the attacker continuing the attack, the dynamic orchestration module enables a new disguised file Fakefile1 (file name is "Production Line Equipment Parameters.cfg"). The system directly locks the account of the attacker who attempts to access Fakefile1 and adds the attacker's IP (192.168.1.101) to the blacklist. The dynamic orchestration module triggers a system alarm through the management module, and the information processing module displays the system alarm to the administrator.

[0102] Finally, the information processing module collects and integrates all data from the threat monitoring module, dynamic orchestration module and log component to generate a detailed attack event report. The attack event report includes: the attacker's IP address and its behavior timeline, the disguised services and disguised files accessed, the defense rules triggered by the system and the adjustment measures; the administrator checks the event report and manually confirms whether the defense rules need to be further adjusted. If new defense rules are constructed, the dynamic orchestration module is updated and the new rules are enabled in the next attack.

[0103] To summarize, the present invention proposes an active defense system for dynamic attack surface transformation of a production system, including: the active defense system includes: a system support module, an interface interpreter module, a mobile target construction module, a dynamic orchestration module, a management module, an information processing module, and a threat monitoring module.

[0104] The system support module provides false and disguised functions for network services, file systems and user account resources. The system support module encapsulates the underlying resource functions through the interface interpreter module and converts them into standard interfaces that can be called by upper-level modules; the interface interpreter module coordinates the interaction between different modules to ensure smooth information flow between modules; the mobile target construction module interacts with the system support module through the interface interpreter, builds and supports dynamic orchestration of disguised network services, disguised file systems and disguised user accounts, and enhances the system's defense capabilities.

[0105] The dynamic orchestration module adjusts the attack surface characteristics by dynamically arranging and changing resources such as network services, file systems, and user accounts. These changes are triggered based on real-time security events detected by the threat monitoring module. When the threat monitoring module finds a potential attack, it passes the relevant threat information to the dynamic orchestration module through the management module. The dynamic orchestration module immediately adjusts the attack surface according to the severity of the threat to increase the difficulty for attackers to identify and exploit vulnerabilities.

[0106] At the same time, the information processing module records the system's operation logs and displays the system status and threat alerts in real time, providing them to administrators for decision-making.

[0107] The steps in the present invention can be adjusted in order, combined or deleted according to actual needs.

[0108] The units in the device of the present invention can be combined, divided and deleted according to actual needs.

[0109] Although the present invention is disclosed in detail with reference to the accompanying drawings, it should be understood that these descriptions are merely exemplary and are not intended to limit the application of the present invention. The scope of protection of the present invention is defined by the appended claims and may include various modifications, alterations and equivalents made to the invention without departing from the scope and spirit of the present invention.

Claims

1. A dynamic attack surface transformation active defense system for a production system, characterized in that: The active defense system includes: a system support module, an interface interpreter module, a mobile target construction module, a dynamic arrangement module, a management module, an information processing module, and a threat monitoring module; The system support module provides false and disguised functions for network services, file systems, and user account resources. The system support module encapsulates the underlying disguised resources through the interface interpreter module and converts them into standard interfaces that can be called by upper-level modules. The programming languages ​​of the system support module and the mobile target building module are different. The interface interpreter module opens up the interface standards between the programming languages ​​of the system support module and the mobile target building module. The mobile target building module interacts with the system support module through the interface interpreter, supports the upper-level dynamic orchestration module to adjust the attack surface characteristics, and performs network service disguise, file system disguise, and user account disguise, which increases the difficulty for attackers to identify and exploit vulnerabilities. When the threat monitoring module finds a potential attack, it passes the relevant threat information to the dynamic orchestration module through the management module. The dynamic orchestration module triggers the dynamic orchestration and change of the underlying disguised resources of network services, file systems, and user accounts according to the threat information, so as to adjust the attack surface characteristics. At the same time, the information processing module records the system's operation logs and displays the system status and threat alerts in real time, providing them to administrators for decision-making.

2. The dynamic attack surface transformation active defense system for production systems according to claim 1, characterized in that: The system support module includes a network component, a file system component, a user environment component and a log component, which respectively provide network camouflage service, file system camouflage, user environment camouflage and operation log recording functions.

3. The dynamic attack surface transformation active defense system for production systems according to claim 2, characterized in that: The interfaces provided by the interface interpreter module include: a network service interface for dynamically configuring disguised services and listening ports; a file system interface for configuring disguised files and access monitoring; and a user environment interface for configuring disguised user accounts and dynamic user environments.

4. The dynamic attack surface transformation active defense system for production systems according to claim 1, characterized in that: The dynamic orchestration module is based on the finite state machine theory, abstracts the states of resources such as network services, file systems, and user accounts in the system into attack surface feature vectors, and adjusts the states of various resources through an event-driven mechanism.

5. The dynamic attack surface transformation active defense system for production systems according to claim 4, characterized in that: The dynamic orchestration module adjusts the configuration of system resources according to the threat information fed back by the threat monitoring module. The adjustment content includes: dynamically changing the configuration of the disguised service; randomizing the file name, permissions and access path of the file system; and dynamically adjusting the root directory and environment configuration of the disguised user account.

6. The dynamic attack surface transformation active defense system for production systems according to claim 1, characterized in that: The active defense system further includes: a security deployment module; the security deployment module implements isolation between the defense system and the production system through a multi-layer sandbox isolation architecture, specifically including: First layer of isolation: The process of the active defense system is isolated from the normal production system process through container technology. The permissions of the container are finely configured and limited to the permissions actually required by the system, avoiding direct interaction between the defense system and the production system. Second layer of isolation: Control access to the production system kernel through whitelist technology to ensure that only authorized processes can access production system resources; The third layer of isolation: Through mandatory access control policies, the interaction between the active defense system and the production system is limited to prevent the defense system from accessing unnecessary objects.

7. The dynamic attack surface transformation active defense system for production systems according to claim 5, characterized in that: The dynamic orchestration module dynamically adjusts the attack surface characteristics at different time points in an event-driven manner, including: At time t1, the production node configures disguised Bind DNS, HTTP server, Samba, FTP, and ApacheTomcat network services to confuse attackers, and records all IP addresses that access the service; At time t2, the production node configures SSH, Bind DNS, Rpcbind, and Mysql network services to redirect all access requests to a specific port. At the same time, the production node configures the Fakefile0 disguised file and monitors external access records to the disguised file. At time t3, the production node reconfigures Bind DNS, HTTP server, and Samba to build a fake file Fakefile1. The system denies all access to the fake file Fakefile1 and locks out users who attempt to access the fake file Fakefile1. The production node reconfigures FTP, Bind DNS, Samba, and Apache Tomcat to build a fake file Fakefile2. The system records all IPs that access the fake file Fakefile2 and transparently filters access requests from the recorded IPs in the global system.

8. A method for active defense of dynamic attack surface transformation for production systems, characterized in that: The active defense method is applied to the dynamic attack surface transformation active defense system for a production system as described in any one of claims 1-7.

Images