Digital twin honeypot generation and network attack containment method based on voting system

Abstract

The invention relates to a digital twin honeypot generation and network attack containment method based on a voting system, and belongs to the technical field of network security. The attack introduction decision is automatically developed through the voting system, the authenticity, interactivity and dynamicity of the honeypot are enhanced through the digital twin technology, the attack luring capability of the honeypot system is enhanced, through the system, precise putting different from traditional honeypots is achieved, and the system is suitable for popularization and application. And the probability that hackers discover and attack the honeypot bait is greatly improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and specifically relates to a method for generating a digital twin honeypot and controlling network attacks based on a voting system. Background Art

[0002] The domestic network security situation is becoming increasingly severe. All kinds of Internet and intranet infrastructure are facing increasingly complex and diverse forms of network attacks and attack paths. Honeypots, as a new defense method that actively traps attack behaviors, can give full play to their advantages of strong targeting and high defense. They can make up for the high false alarm rate and low defense of traditional firewalls, intrusion detection systems, etc., disrupt the sight and thinking of external attacks, and greatly improve the security of network infrastructure.

[0003] Traditional honeypots are separated from business systems and have varying degrees of trapping capabilities. They have the following shortcomings:

[0004] 1. After traditional honeypots identify attack behaviors, they cannot accurately judge which honeypot locations will be used to introduce the attack, and cannot accurately trap attackers, resulting in a greater possibility of being identified.

[0005] 2. Most of the existing honeypots are seriously separated from the business. The existing honeypots have weak simulation and authenticity of the business, and are easily identified by advanced attackers, thus reducing the defense capability.

[0006] 3. Dynamically deploy honeypots, use the monitored network information for dynamic deployment and configuration, perceive the surrounding network environment, configure an appropriate number of honeypots, and make adjustments as the network environment changes. However, the most important function of dynamically deploying honeypots is to introduce different attacks into the corresponding honeypots, and the authenticity of the honeypots must be strong enough to enable attackers to increase their attack on the honeypot system. Summary of the invention

[0007] 1. Technical issues to be resolved

[0008] The technical problem to be solved by the present invention is to provide a honeypot generation and network attack containment system and method to increase the probability of hackers discovering and attacking honeypot baits and improve the defense capability of the honeynet.

[0009] (II) Technical solution

[0010] In order to solve the above technical problems, the present invention provides a design method for a digital twin honeypot generation and network attack containment system based on a voting system, comprising:

[0011] Anomaly detection module, used to proactively identify and detect abnormal traffic, collect malicious request information, including attack IP, attack device fingerprint information, attack behavior, attack method, open ports, and abnormal feature information of services;

[0012] The digital twin honeypot generation module is used to generate a digital twin honeypot that can meet the attacker's attack intention based on the business traffic information and interface network information shared in the real business system. Each digital twin honeypot can be regarded as an independent device and is assigned a legal external IP address to simulate any real operating system, database or application system, and actively respond to security incidents initiated by attackers;

[0013] The voting system module is used to generate corresponding features after analyzing the attack behavior of the attacking host according to the abnormal feature information output by the abnormal detection module, and substitute them into the fuzzy voting algorithm to calculate the best allocation honeypot, so as to lock the attack in the allocated honeypot;

[0014] The attack traction module is used to pull the attack traffic to multiple ordinary honeypots or multiple digital twin honeypots according to the decision results of the voting system module, so that the attacker can perform attack behaviors in a complete virtual environment while recording and monitoring the attack behaviors.

[0015] The invention also provides a system designed based on the method.

[0016] The present invention also provides a method for generating a digital twin honeypot and controlling a network attack based on the system, comprising the following steps:

[0017] First, the anomaly detection module collects traffic in the entire network, detects abnormal traffic through intelligent traffic, and records the attack IP, device fingerprint information, attack behavior, attack method, open ports, and abnormal feature information of services;

[0018] The digital honeypot generation module generates a digital twin honeypot based on the real traffic data of the real business system;

[0019] Secondly, the voting system module allocates targeted digital twin honeypots or ordinary honeypots based on the detected abnormal feature information;

[0020] Then, the attack traction module redirects the attack traffic to the digital twin honeypot generated by the digital honeypot generation module based on the real traffic data of the real business system or redirects it to the ordinary honeypot;

[0021] Next, it is determined whether the attacker successfully communicates with the digital twin honeypot or the ordinary honeypot. If not, the digital twin honeypot or the ordinary honeypot is allocated again through the voting system module, and the next step is executed; if yes, the digital honeypot generation module imports more business traffic and interface type information in the real business system into the digital twin honeypot; at the same time, high interactive communication between different digital twin honeypots is realized, and the next step is executed;

[0022] Finally, the attack traction module redirects the attack traffic to different ordinary honeypots or different high-interaction, high-simulation digital twin honeypots, and guides and records the attack behavior, traps the attack behavior, and records the attack information.

[0023] (III) Beneficial effects

[0024] 1. Based on the results of abnormal behavior detection, the present invention generates a digital twin honeypot allocation decision that is targeted and can meet the intruder's attack intention through a voting algorithm, which better saves limited computing resources and network resources. Only a few honeypots can firmly contain network attacks and protect the real network system;

[0025] 2. When the virtual honeypot and the attack host are interrupted in response, or the intruder sees through the virtual honeypot, the present invention continuously updates the digital twin honeypot by combining the virtual and the real, and inputs the data and business flows in the real business system into the digital twin honeypot after being processed by encryption calculations, etc., so that it continuously iterates and evolves in terms of interactivity, authenticity, diversity, etc., thereby luring attackers to continuously fall into the digital twin honeypot. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 The overall architecture diagram of the trapping honeypot generation and network attack containment system based on diversity expansion of the present invention is given, and the module design, data flow and interaction of the present invention are given;

[0027] Figure 2 The overall flow chart of the digital twin honeypot generation and network attack containment method based on the voting system of the present invention is given, and the specific implementation process of the present invention is given. DETAILED DESCRIPTION

[0028] In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below in conjunction with the drawings and examples.

[0029] The present invention proposes a digital twin honeypot generation and network attack containment system and method for a voting system, aiming to automatically carry out attack introduction decisions through a voting system, and at the same time enhance the authenticity, interactivity and dynamism of the honeypot through digital twin technology, and enhance the ability of the honeypot system to induce attacks. Through this system, precise delivery different from traditional honeypots is achieved, greatly improving the probability of hackers discovering and attacking honeypot baits.

[0030] The present invention provides a method for generating a digital twin honeypot based on a voting system and containing network attacks. By making decisions on the introduction of honeypots to attackers through a voting system model, the success rate of trapping can be improved, the risk of attacks on real network infrastructure equipment is reduced, and the authenticity of trapping honeypots for complex networks such as the Internet, corporate intranets, and industrial control networks is realized. The deception of attackers solves the problems of easy identification of traditional honeypots and low trapping accuracy to a certain extent, and improves the defense capability of the honeynet as a whole. The present invention is a dynamic defense method for common complex network security threat environments, which is used to trap known and unknown threats such as reconnaissance, access, deception, attack utilization, payload delivery, information leakage, and information tampering.

[0031] This method is implemented based on four parts: anomaly detection module, digital twin honeypot generation module, voting system module, and attack traction module. First, the anomaly detection module is used to identify and detect potential network attacks; secondly, the digital honeypot generation module is used to generate a digital twin honeypot that can confuse attackers, truly simulating the high interactive characteristics of the business system; then, the voting system module is used to decide the direction of attack introduction through the fuzzy voting algorithm based on the identification and detection results of the anomaly detection module; finally, the attack traction module pulls the attacker to the highly simulated digital twin honeypot according to the decision results of the voting system module.

[0032] Figure 1 It is a module design and overall architecture of a trapping honeypot generation and network attack containment system based on diversity expansion, including:

[0033] (1) The anomaly detection module identifies and detects potential network attack behaviors, records attack IP, device fingerprint information, attack behavior, attack method, open ports and services, and sends it to the voting system module;

[0034] (2) The voting system module uses a fuzzy voting algorithm to decide which digital twin honeypot the attack should be assigned to based on the abnormal feature information output by the anomaly detection module, in order to achieve the greatest confusion effect;

[0035] (3) The attack traction module distributes the attack traffic to the corresponding ordinary honeypot or digital twin honeypot according to the decision results of the voting system module. The digital twin honeypot is generated by the digital honeypot generation module.

[0036] Figure 2 This is the overall process of the digital twin honeypot generation and network attack containment method based on the voting system. The specific process is:

[0037] (1) First, the anomaly detection module collects traffic in the entire network, detects abnormal traffic through intelligent traffic, and records abnormal feature information such as attack IP, device fingerprint information, attack behavior, attack method, open ports and services;

[0038] (2) Secondly, the voting system module allocates targeted digital twin honeypots or ordinary honeypots based on the detected abnormal feature information;

[0039] (3) Then, the attack traction module redirects the attack traffic to the digital twin honeypot or the ordinary honeypot;

[0040] (4) Next, determine whether the attacker successfully communicates with the digital twin honeypot or the ordinary honeypot. If not, the digital twin honeypot or the ordinary honeypot is allocated again through the voting system module, and the next step is executed; if yes, the digital honeypot generation module imports more information such as business traffic and interface type in the real business system into the digital twin honeypot; at the same time, high interactive communication between different digital twin honeypots is realized, and the next step is executed;

[0041] (5) Finally, the attack traction module redirects the attack traffic to different ordinary honeypots or different high-interaction, high-simulation digital twin honeypots, guides and records the attacker's behavior, traps the attack behavior, and records the attack information.

[0042] The diversity-expanded trapping honeypot generation and network attack containment system of the present invention includes the following four modules:

[0043] (1) Anomaly detection module, which is used to actively identify and detect abnormal traffic information, exclude normal communication behaviors such as network connections, and collect malicious request information, including attack IP, device fingerprint information, attack behavior, attack method, open ports and services, and other characteristic information.

[0044] (2) The digital twin honeypot generation module automatically generates a digital twin honeypot that can meet the intruder's attack intention based on the business traffic information, interface network and other information shared in the real business system. Each digital twin honeypot can be regarded as an independent device and is assigned a legal external IP address to simulate any real operating system, database, application system, etc., and actively respond to security incidents initiated by intruders.

[0045] (3) The voting system module uses the fuzzy voting algorithm to generate corresponding features after analyzing the attack behavior of the attacking host, and substitutes them into the algorithm to calculate the optimal allocation of honeypots to better meet its attack mode, attack intention, and attack capability, and firmly lock the attack in the digital twin honeypot.

[0046] (4) An attack traction module is used to tract attack traffic to multiple ordinary honeypots or multiple digital twin honeypots, allowing attackers to conduct attack behaviors in a complete virtual environment while recording and monitoring the attack behaviors.

[0047] The implementation method of the anomaly detection module includes:

[0048] The anomaly detection module is deployed at the communication entrance of the entire network to collect traffic data entering the business network. It detects abnormal traffic through the pre-learned anomaly detection warning model. Abnormal traffic is generally used for attack traffic such as scouting, scanning, malicious implantation, password cracking, and vulnerability exploitation. After detecting malicious traffic, it records the characteristic information such as the attacker IP of the malicious request, the fingerprint information of the attack device, the attack behavior, the attack characteristics, the open ports and services. The anomaly detection module integrates the key parts of the information in the network traffic to characterize the core characteristics of the traffic. In addition to the traditional known attack behavior detection based on the pre-attack feature library, the pre-trained LSTM neural network model is used to detect malicious traffic to improve the detection efficiency of unknown threats.

[0049] The implementation method of the digital twin honeypot generation module includes:

[0050] The digital twin honeypot generation module includes an information simulation service module, a network data conversion module, and a honeypot data introduction module. According to the real business flow data information collected by the information service simulation module, such as the flow data is L n ={X a ,a,X b}, where X in the traffic package a , X b The data stream is a, which is processed by the network data conversion module through streaming encryption calculation and other privacy processing to generate the privacy data stream p, and then the integrity check algorithm such as CRC is used to generate the encrypted data X c , repackaging and combining to generate data stream L m ={X a ,p,X c}The digital twin honeypot is imported through the honeypot data introduction module to increase the security, authenticity and obfuscation of the honeypot; after the real traffic data is imported into the network data conversion module, it is encrypted and transparently forwarded to the business system in the digital twin honeypot, thereby creating a realistic simulated business traffic. For example, if an HTTPS traffic data sent between online collaborative text writing software occurs in the real business network, the digital twin honeypot generation module can collect the HTTPS traffic data of the business and store it in the digital twin honeypot after privacy encryption. The information service simulation module replays the data appropriately according to the needs of the digital twin honeypot, and imitates the interaction behavior between the corresponding IP addresses of the digital twin honeypot, which can meet the data simulation requirements and business simulation requirements of the digital twin honeypot and enhance the obfuscation of the digital twin honeypot.

[0051] The implementation method of the voting system module includes:

[0052] (1) Obtain the attacker’s profile through the anomaly detection module, which includes the following information as input to the voting system module: attacker IP, attack device fingerprint information, attack behavior, attack characteristics, open ports and services, and other abnormal characteristic information;

[0053] (2) The voting system module determines whether to introduce the attack traffic into one of multiple ordinary honeypots or multiple digital twin honeypots, thereby enhancing the targeting of attack trapping. The n attacker profile information collected by the anomaly detection module is sent to n channels for voting, which controls the overall error rate within an extremely low range and improves the targeting of the honeypot. In addition to fault tolerance, the voting technology is introduced into the diversified hardware and software implementations to improve security and reduce the threats brought by inevitable vulnerabilities or backdoors.

[0054] (3) The information of n channels includes source IP, access IP, whether it is port scanning, weak password scanning, vulnerability scanning, operating system detection, vulnerability scanning attack, file hash used by the attack source, malicious domain name, IP address, C&C domain name, malicious certificate hash, etc. These information are defined as voting input a1, a2, a3, a4…a n If it is more advanced hacking behavior, then assign: a n =2, if it is a normal machine scanning attack, then assign a n =1, if there is no obvious attack style feature, assign value a n =0, there are n input quantities in total, add up the data: S = a1+a2+a3+…a n, set the threshold of high-threat behavior to Y. If S≥Y, then the attack traffic is introduced into the digital twin honeypot. If S≤Y, then the attack traffic is introduced into the ordinary honeypot. Thus, the voting algorithm is used to decide whether the attack traffic is introduced into the digital twin honeypot or the ordinary honeypot. For example, attackers with high-risk behaviors can vote to enter the high-interaction honeypot to enhance the confusion and increase the probability of trapping, while attacks with ordinary low-risk behaviors are pulled to the ordinary honeypot according to the voting results. Different attack methods can be divided into advanced hacker behaviors or machine automatic scanning behaviors according to their methods. Attackers are assigned to digital twin honeypots and ordinary honeypots through the voting system module, thereby improving the economy of system construction and avoiding unnecessary server and resource expenses.

[0055] The implementation method of the attack traction module includes:

[0056] Migrate the attack traffic to the allocated digital twin honeypot or ordinary honeypot. Specifically, by implementing application layer protocol attack behavior detection on the protected host, monitoring abnormalities and unauthorized behaviors, the attacker's traffic is smoothly migrated to the corresponding digital twin honeypot or ordinary honeypot. The attack traction module migrates the attack traffic to different honeypots according to the honeypot number assigned by the voting system module through netfiler / iptables customized rules, and returns false information to the attacker. Use / iptables traffic forwarding to complete packet filtering, packet redirection and traffic forwarding, introduce abnormal traffic into the digital twin honeypot or ordinary honeypot, thereby restraining the hacker's attack in the honeypot, returning false business information, monitoring and collecting the attack packets used by the attacker, so as to achieve the purpose of protecting the real business network and record the attacker's data flow for backtracking.

[0057] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A design method for digital twin honeypot generation and network attack containment system based on voting system, characterized in that: include: Anomaly detection module, used to proactively identify and detect abnormal traffic, collect malicious request information, including attack IP, attack device fingerprint information, attack behavior, attack method, open ports, and abnormal feature information of services; The digital twin honeypot generation module is used to generate a digital twin honeypot that can meet the attacker's attack intention based on the business traffic information and interface network information shared in the real business system. Each digital twin honeypot can be regarded as an independent device and is assigned a legal external IP address to simulate any real operating system, database or application system, and actively respond to security incidents initiated by attackers; The voting system module is used to generate corresponding features after analyzing the attack behavior of the attacking host according to the abnormal feature information output by the abnormal detection module, and substitute them into the fuzzy voting algorithm to calculate the best allocation of honeypots, so as to lock the attack in the allocated honeypot; The attack traction module is used to pull the attack traffic to multiple ordinary honeypots or multiple digital twin honeypots according to the decision results of the voting system module, so that the attacker can perform attack behaviors in a complete virtual environment while recording and monitoring the attack behaviors.

2. The method according to claim 1, characterized in that The implementation method of the anomaly detection module includes: the anomaly detection module is deployed at the communication entrance of the entire network, and is used to collect traffic data entering the network. The abnormal traffic is detected by a pre-trained anomaly detection early warning model. The abnormal traffic is attack traffic used for scouting, scanning, malicious implantation, password cracking, and vulnerability exploitation. After the abnormal traffic is detected, the attacker IP of the malicious request, the fingerprint information of the attack device, the attack behavior, the attack characteristics, the open ports and services and other abnormal characteristic information are recorded.

3. The method according to claim 2, characterized in that The anomaly detection and early warning model is an LSTM neural network model.

4. The method according to claim 1, characterized in that The implementation method of the digital twin honeypot generation module includes: the digital twin honeypot generation module includes an information simulation service module, a network data conversion module, and a honeypot data introduction module; the business flow information L collected by the information service simulation module n ={X a ,a,X b }, where X a , X b is the head and tail of the real message header data, the data stream is a, after the privacy processing of the stream encryption calculation is performed by the network data conversion module, the private data stream p is generated, and then the encrypted data X is generated by the integrity verification algorithm c , repackaging and combining to generate data stream L m ={X a ,p,X c }, the digital twin honeypot is imported through the honeypot data introduction module; after the real traffic data is imported into the network data conversion module, it is encrypted and transparently forwarded to the business system in the digital twin honeypot, thus creating a realistic simulated business traffic.

5. The method according to claim 1, characterized in that If an online collaborative text writing software sends HTTPS traffic data to each other in a real business network, the digital twin honeypot generation module will collect the HTTPS traffic data of the business and store it in the digital twin honeypot after privacy encryption processing. The information service simulation module will replay the data appropriately according to the needs of the digital twin honeypot and simulate the interaction behavior between the corresponding IP addresses of the digital twin honeypot to meet the data simulation requirements and business simulation requirements of the digital twin honeypot.

6. The method according to claim 1, characterized in that The implementation method of the voting system module includes: (1) Obtain the attacker’s profile through the anomaly detection module, which includes the following information as input to the voting system module: attacker IP, attack device fingerprint information, attack behavior, attack characteristics, open ports, and abnormal characteristic information of services; (2) The voting system module determines the threat level of the attacker based on the abnormal feature information, and determines whether to introduce the attack traffic into the ordinary honeypot or the digital twin honeypot based on the threat level. The details are as follows: the information of the n attacker portraits collected by the anomaly detection module is sent to n channels for voting to determine which digital twin honeypot to introduce; the information of the n channels includes the source IP, access IP, whether it is a port scan, weak password scan, vulnerability scan, operating system detection, vulnerability scan attack, file hash used by the attacker, malicious domain name, IP address, C&C domain name, malicious certificate hash information, and these information are defined as voting input a1, a2, a3, a4…a n If it is more advanced hacking behavior, then assign: a n =2, if it is a normal machine scanning attack, then assign a n =1, if there is no obvious attack style feature, assign value a n =0, there are n input quantities in total, add up the data: S = a1+a2+a3+…a n , set the threshold of high-threat behavior to Y. If S≥Y, then the attack traffic is introduced into the digital twin honeypot and a honeypot number is assigned. If S≤Y, then the attack traffic is introduced into the ordinary honeypot and a honeypot number is assigned.

7. The method according to claim 1, characterized in that The implementation method of the attack traction module includes: by implementing application layer protocol attack behavior detection on the protected host, monitoring anomalies and unauthorized behaviors, the attack traffic is smoothly migrated to the corresponding digital twin honeypot or ordinary honeypot; the attack traction module migrates the attack traffic to different honeypots according to the honeypot number assigned by the voting system module through netfiler / iptables customized rules, and returns false information to the attacker; using / iptables traffic forwarding to complete packet filtering, packet redirection and traffic forwarding, and introduce the attack traffic into the digital twin honeypot or ordinary honeypot, thereby restraining the hacker's attack in the honeypot, returning false business information, and monitoring and collecting the attack packets used by the attacker for backtracking.

8. A system designed based on the method according to any one of claims 1 to 6.

9. A method for generating a digital twin honeypot and controlling network attacks based on the system as claimed in claim 8, characterized in that: The following steps are involved: First, the anomaly detection module collects traffic in the entire network, detects abnormal traffic through intelligent traffic, and records the attack IP, device fingerprint information, attack behavior, attack method, open ports, and abnormal feature information of services; The digital honeypot generation module generates a digital twin honeypot based on the real traffic data of the real business system; Secondly, the voting system module allocates targeted digital twin honeypots or ordinary honeypots based on the detected abnormal feature information; Then, the attack traction module redirects the attack traffic to the digital twin honeypot generated by the digital honeypot generation module based on the real traffic data of the real business system or redirects it to the ordinary honeypot; Next, it is determined whether the attacker successfully communicates with the digital twin honeypot or the ordinary honeypot. If not, the digital twin honeypot or the ordinary honeypot is allocated again through the voting system module, and the next step is executed; if yes, the digital honeypot generation module imports more business traffic and interface type information in the real business system into the digital twin honeypot; at the same time, high interactive communication between different digital twin honeypots is realized, and the next step is executed; Finally, the attack traction module redirects the attack traffic to different ordinary honeypots or different high-interaction, high-simulation digital twin honeypots, and guides and records the attack behavior, traps the attack behavior, and records the attack information.

10. The method according to claim 9, characterized in that The method is applied in the field of network security technology.

Images