Configuration file protection method based on dynamic redirection

Abstract

The invention provides a configuration file protection method based on dynamic redirection, and relates to the technical field of information security. The configuration file protection method comprises the following steps: identifying a to-be-protected configuration file based on a system, transferring the to-be-protected configuration file to a safe storage position, and generating a highly-simulated bait configuration file on an original path of the to-be-protected configuration file based on software and hardware characteristics of user terminal equipment; automatically capturing a process requesting to access the configuration file to be protected based on a file system filter driver, transmitting the process to a redirection decision engine, and judging the process requesting to access based on the redirection decision engine; and when the request process is judged to be a legal behavior request process, the system redirects an access path to a real configuration file, and when the request process is judged to be an abnormal or suspicious request, the request process path is redirected to a bait configuration file, and the process is induced to access forged data. According to the configuration file protection method provided by the invention, transparent protection on the configuration file of the client is realized, and the safety and the confusion are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of information security, and in particular to a configuration file protection method based on dynamic redirection. Background Art

[0002] With the rapid development of information technology and the Internet, personal terminal devices have become important tools for users to access the network and manage data. Modern client applications and operation and maintenance tools usually store a large number of configuration files on user devices. These files contain sensitive content such as user accounts, keys, network configuration information, etc., which facilitate users to quickly access personalized services. However, once the client configuration files are stolen by malicious attackers, it may lead to the theft of user accounts, system intrusion, and even cause serious information leakage and property losses. Attacks on configuration files are increasing, so it is necessary to improve the security protection of client configuration files.

[0003] In the field of network security, honeypot and honeytoken technologies are becoming increasingly popular as active defense means. Honeypot technology creates fake systems or network nodes to trap attackers and record their attack behaviors. Honeytokens are fake digital resources with tags, such as fake accounts, files, or database records, deployed in key system locations to induce attackers to try to exploit these resources. However, honeypot and honeytoken technologies are more commonly used on the server side and in centrally managed systems. The existing honeytoken deployment and decoy mechanisms mainly protect databases and key nodes, and lack effective protection for terminal client configuration files.

[0004] Therefore, it is urgent to provide a solution to solve the above problems. Summary of the invention

[0005] The purpose of the present invention is to provide a configuration file protection method based on dynamic redirection, which improves the problem of insufficient security of configuration file protection in the prior art.

[0006] The present invention provides a configuration file protection method based on dynamic redirection, which adopts the following technical solution:

[0007] Based on the system identifying the configuration file to be protected and transferring it to a secure storage location, a highly simulated decoy configuration file is generated in the original path of the configuration file to be protected based on the software and hardware characteristics of the user terminal device;

[0008] Automatically capture the process that requests to access the configuration file to be protected based on the file system filter driver, and extract the key attributes of the process and pass them to the redirection decision engine, which determines the process that requests access based on blacklist and whitelist filtering rules, context environment detection, and behavior pattern analysis;

[0009] When a request process is judged to be a legitimate behavior, the system will redirect the access path to the real configuration file. When it is judged to be an abnormal or suspicious request, the request process path will be redirected to the bait configuration file to induce the process to access forged data.

[0010] Optionally, the system identifies the configuration files to be protected and transfers them to a secure storage location, including:

[0011] When the system is run for the first time, it will automatically scan, identify and record all installed applications and software that support configuration file redirection. The scan results include software name, version information and default path of configuration files, and store the results in an encrypted database file.

[0012] The system displays the scanning results to the user in the form of a list, outputs a prompt for the user to select a configuration file of the application to be protected, and transfers the extracted configuration file information to be protected to a secure storage area based on the user's selection.

[0013] Optionally, the process of generating a highly simulated decoy configuration file in the original path of the configuration file to be protected based on the software and hardware characteristics of the user terminal device includes:

[0014] According to the software and hardware characteristics of the user's terminal device, the usage pattern and access characteristics of the configuration file are analyzed, and the structural template of the real configuration file is used in combination with random parameters to generate a highly simulated bait file in the original path of the configuration file to be protected, and the bait account and password information are set for the account and password fields of the configuration file.

[0015] Optionally, after the user selects the configuration file of the application to be protected, the server-side collaborative module will filter the honeypot that matches the selected program from the honeypot library based on the selected program, and deploy it to the isolated server environment. The honeypot will focus on monitoring the set bait account and capture any attack activities that attempt to use the bait account for illegal access.

[0016] Optionally, the process of automatically capturing the process requesting to access the configuration file to be protected based on the file system filter driver and extracting key attributes of the process and transferring them to the redirection decision engine includes:

[0017] When a process initiates an access request and attempts to access the configuration file to be protected, the file system filter driver will automatically capture the request and interrupt the process to directly enter the file system;

[0018] After capturing the access request, the filter driver extracts the key attributes of the request and passes them to the redirection decision engine. The key attributes include the target file path, the process ID that initiated the request, and the access mode.

[0019] Optionally, the redirection decision engine determines the process requesting access based on blacklist and whitelist filtering rules, context environment detection, and behavior pattern analysis, including:

[0020] Obtaining a system whitelist and blacklist, wherein the whitelist contains authorized processes and the blacklist includes known malicious processes or software explicitly marked as a threat;

[0021] The process requesting access is judged based on the blacklist and whitelist. When the process requesting access matches the whitelist rules, it is directly judged as trusted access and the path is redirected to the real configuration file path. When the process requesting access matches the blacklist rules, it is directly judged as untrusted access and the path is redirected to the bait file path. When the process requesting access matches neither the whitelist nor the blacklist, the process requesting access is judged based on context environment detection and behavior pattern analysis.

[0022] Optionally, the process of determining the process requesting access based on context detection and behavior pattern analysis includes:

[0023] Analyze the system context and process context, and map the system context and process context features into the scoring function for comprehensive evaluation, and obtain the abnormality score of the current system status and access behavior. When the score exceeds the threshold, the system determines that the current environment is abnormal, and marks the process requesting access as a potential threat, redirecting the path to the bait file path, otherwise the process requesting access is judged based on the behavior pattern analysis;

[0024] The system context includes CPU occupancy, number of network connections, system running time, and user authority level; the process context environment includes the parent process chain that initiated the process, memory occupancy, number of threads and their behavior patterns.

[0025] Optionally, the process of determining the process requesting access based on the behavior pattern analysis includes:

[0026] Based on a fixed time window defined by the system, historical behavior data of the process is extracted and a time behavior sequence is formed based on time sorting;

[0027] The downsampling factor is calculated based on the activity of the time behavior series, and the behavior data of the time behavior series is sparsely processed based on the dynamic downsampling mechanism;

[0028] The downsampled time behavior sequence is input into the fast dynamic time warping algorithm, and the similarity is matched with the templates in the malicious behavior template library to obtain the matching distance;

[0029] When the matching distance exceeds a preset abnormal threshold, the current behavior sequence is determined to be abnormal, and the process path is redirected to the bait file, otherwise the path is redirected to the real configuration file path.

[0030] Optionally, the process of extracting the historical behavior data of the process and forming a time behavior sequence based on time order includes:

[0031] When the process is run for the first time or the historical behavior data is insufficient, the system will first refer to the behavior characteristics of the parent process to fill in the actual part; when the behavior data of the parent process is unavailable, the missing data will be inferred based on the known behavior characteristics through zero filling or neighboring interpolation, thereby ensuring the integrity of the time series and the accuracy of the analysis.

[0032] Optionally, the client is responsible for monitoring all access behaviors to the bait configuration files and reporting the access logs to the server, which will record and issue an alarm. The honeypot of the server-side collaborative module is responsible for capturing login or other illegal access behaviors to the bait account, and generates a complete attack path analysis report in combination with the access logs, sending detailed alarm information to the user and informing him that the device may have been hacked.

[0033] The invention provides a configuration file protection method based on dynamic redirection, which has the following beneficial effects:

[0034] 1. The present invention realizes transparent protection of client configuration files through dynamic redirection technology, can intelligently identify access behaviors and guide abnormal requests to bait files without user program changes, thus improving security and obfuscation;

[0035] 2. The redirection decision engine combines blacklists and whitelists, context analysis, and behavior pattern analysis, taking into account both real-time and accuracy, and constructs a hierarchical comprehensive judgment system, which significantly improves the detection accuracy of malicious access behavior;

[0036] 3. Generate highly simulated bait files through the client and deploy them in the real configuration file path, and combine with the server-side honeypot system to guide abnormal access behavior. It has high scalability and practicality, and can effectively defend against various attack threats against configuration files. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 A flow chart of a configuration file protection method based on dynamic redirection provided by the present invention. DETAILED DESCRIPTION

[0038] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be understood by people with general skills in the field to which the present invention belongs. "Including" and similar words used in this article mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0039] The embodiment of the present invention provides a configuration file protection method based on dynamic redirection, see Figure 1 ,include:

[0040] S1. Based on the system identifying the configuration file to be protected and transferring it to a secure storage location, a highly simulated decoy configuration file is generated in the original path of the configuration file to be protected based on the software and hardware characteristics of the user terminal device;

[0041] S2, automatically capturing the process requesting access to the configuration file to be protected based on the file system filter driver, and extracting the key attributes of the process and passing them to the redirection decision engine, the redirection decision engine determines the process requesting access based on blacklist and whitelist filtering rules, context environment detection, and behavior pattern analysis;

[0042] S3. When the request process is judged to be a legitimate behavior, the system will redirect the access path to the real configuration file. When it is judged to be an abnormal or suspicious request, the request process path will be redirected to the bait configuration file to induce the process to access forged data.

[0043] In some embodiments, the process of executing step S1 includes:

[0044] S1.1. Identify the configuration files to be protected based on the system and transfer them to a secure storage location;

[0045] S1.2. Generate a highly simulated decoy configuration file in the original path of the configuration file to be protected based on the software and hardware characteristics of the user terminal device;

[0046] S1.3. Deploy honeypot based on the server-side collaborative module.

[0047] Specifically, when executing step S1.1, it includes: when the system is run for the first time, it will automatically scan, identify and record a list of all installed applications and software that support configuration file redirection. The scanning results include the software name, version information and the default path of the configuration file, and the results are stored in an encrypted database file.

[0048] Furthermore, the system displays the scanning results to the user in the form of a list, outputs a prompt for the user to select a configuration file of the application to be protected, and transfers the extracted configuration file information to be protected to a secure storage area based on the user's selection.

[0049] Specifically, when executing step S1.2, it includes: analyzing the usage mode and access characteristics of the configuration file according to the software and hardware characteristics of the user terminal device, using the structural template of the real configuration file and combining random parameters to generate a highly simulated bait file in the original path of the configuration file to be protected, and setting the bait account and password information for the account and password fields of the configuration file.

[0050] Specifically, when executing step S1.3, it includes: after the user selects the configuration file of the application to be protected, the server-side collaborative module will filter the honeypot that matches the selected program from the honeypot library based on the selected program, and deploy it to the isolated server environment. The honeypot will focus on monitoring the set bait account and capture any attack activities that attempt to use the bait account for illegal access.

[0051] In fact, on the client side, the system first automatically identifies the program that needs to be protected and its configuration file path, transfers the real configuration file from the original path to the new path, and generates a bait file that is highly similar to the real configuration file and deploys it in the original path of the real configuration file to induce and confuse potential attacks. At the same time, the client is responsible for monitoring all access behaviors to the bait configuration file and judging the legitimacy of the process access through the decision engine. Once abnormal access behavior is found, the system will record it and synchronize it to the server in real time, so that the server can conduct centralized analysis and rapid response. This deployment and monitoring process of the client ensures the local protection effect of the bait configuration file, allowing the application to achieve transparent protection of the configuration file without changing the way it is used.

[0052] Furthermore, on the server side, the system uses the collaborative module to centrally analyze the abnormal behavior data transmitted by the client. The server summarizes and analyzes the access records and abnormal behavior characteristics reported by the client, and dynamically adjusts the deployment content and protection strategy of the bait file by combining threat intelligence and historical attack data. At the same time, the server supports centralized management and rapid distribution of policies, and can synchronize updated bait file configurations and access rules to multiple clients to respond to new threats or changing attack patterns. In addition, the server cooperates with the honeypot system to guide abnormal access behaviors into a virtual honeypot environment, recording the attacker's behavior trajectory, attack methods, and utilization paths. This method can not only further confuse attackers, but also provide rich data support for subsequent traceability analysis and behavior pattern research.

[0053] In some embodiments, the process of executing step S2 includes:

[0054] S2.1, automatically capturing the process that requests to access the configuration file to be protected based on the file system filter driver;

[0055] S2.2, extracting the key attributes of the process and transferring them to the redirection decision engine;

[0056] S2.3. Determine the process requesting access based on blacklist and whitelist filtering rules, context environment detection, and behavior pattern analysis.

[0057] Specifically, when executing step S2.1, it includes: when a process initiates an access request and attempts to access the configuration file to be protected, the file system filter driver automatically captures the request and interrupts the process to directly enter the file system.

[0058] Among them, the File System Filter Driver is a kernel-level technology that implements real-time interception and processing of file operation requests by loading the driver module into the file system driver stack of the operating system. It can intercept these file operation requests before they reach the file system, thus providing a technical basis for dynamic redirection.

[0059] Further, step S2.2 is executed. After capturing the access request, the filter driver extracts key attributes of the request and passes these key attributes to the redirection decision engine. The key attributes include the target file path, the process ID that initiates the request, and the access mode.

[0060] Specifically, the process of executing step S2.3 includes:

[0061] S2.3.1. Determine the process requesting access based on blacklist and whitelist filtering rules;

[0062] S2.3.2, judging the process requesting access based on context detection;

[0063] S2.3.3. Determine the process requesting access based on behavior pattern analysis.

[0064] Specifically, when executing step S2.3.1, it includes:

[0065] Obtaining a system whitelist and blacklist, wherein the whitelist contains authorized processes and the blacklist includes known malicious processes or software explicitly marked as a threat;

[0066] The process requesting access is judged based on the blacklist and whitelist. When the process requesting access matches the whitelist rules, it is directly judged as trusted access and the path is redirected to the real configuration file path. When the process requesting access matches the blacklist rules, it is directly judged as untrusted access and the path is redirected to the bait file path. When the process requesting access matches neither the whitelist nor the blacklist, the process requesting access is judged based on context environment detection and behavior pattern analysis.

[0067] In fact, the black and white list filtering rules are the first-level filtering mechanism of the redirection decision engine. The purpose is to quickly screen out completely trusted and completely untrusted access behaviors. The white list contains authorized processes, such as system core processes and known trusted applications; the black list includes known malicious processes or software that is clearly marked as a threat.

[0068] Specifically, when executing step S2.3.2, it includes:

[0069] The system context environment and process context environment are analyzed, and the system context environment and process context environment characteristics are mapped into the scoring function for comprehensive evaluation to obtain the abnormality score of the current system status and access behavior. When the score exceeds the threshold, the system determines that the current environment is abnormal, and marks the process requesting access as a potential threat, redirects the path to the bait file path, and conversely, the process requesting access is judged based on the behavior pattern analysis; the system context includes CPU occupancy, number of network connections, system running time, and user authority level; the process context environment includes the parent process chain of the initiating process, memory occupancy, number of threads and its behavior pattern.

[0070] Furthermore, the mathematical expression of the scoring function is as follows:

[0071]

[0072] Among them, Score context is the abnormality score, f i (x) represents the score function of the i-th context feature, w iis the feature weight, and n is the total number of features.

[0073] Furthermore, the feature weights are initialized using the frequency weight method, with the weight w i The allocation is based on the frequency of the association of features with abnormal behaviors in historical logs, and the calculation formula is as follows:

[0074]

[0075] Among them, Fq(f i ) represents the feature f i Frequency of occurrence in abnormal behavior records, It is the sum of all feature frequencies. Through normalization processing, it ensures that the sum of the weights of all features is 1. The initialization data of the weights comes from the historical system logs and abnormal behavior case library, and is counted in combination with the long-term operating environment.

[0076] Specifically, when executing step S2.3.3, it includes:

[0077] S2.3.3.1, define the time window to extract the time behavior sequence;

[0078] S2.3.3.2, sparse processing of time behavior series based on dynamic downsampling mechanism;

[0079] S2.3.3.3. Calculate the matching distance between the time behavior sequence and the malicious behavior template library;

[0080] S2.3.3.4. Make an abnormality determination.

[0081] Specifically, when executing step S2.3.3.1, it includes: defining a fixed time window based on the system, extracting the historical behavior data of the process and forming a time behavior sequence based on time sorting; the time behavior sequence includes system call sequence, file operation frequency, network connection activity, memory usage, etc.

[0082] In fact, the time window can be defined as 5 minutes and updated in real time in a sliding manner to ensure the capture of the latest behavior data while maintaining the continuity and real-time nature of the calculation; the extracted behavior data is then sorted by time to form a time behavior sequence sequence S T ={s t-T ,s t-T+1 ,…,s t}, where element s t Represents the process behavior at time point t.

[0083] Furthermore, when the process is run for the first time or the historical behavior data is insufficient, the system will give priority to referring to the behavior characteristics of the parent process to fill in the actual part; when the behavior data of the parent process is unavailable, the missing data will be inferred based on the known behavior characteristics through zero filling or neighboring interpolation, thereby ensuring the integrity of the time series and the accuracy of the analysis.

[0084] Specifically, when executing step S2.3.3.2, it includes: calculating the downsampling factor based on the activity of the time behavior sequence, and performing sparse processing on the behavior data of the time behavior sequence based on the dynamic downsampling mechanism.

[0085] Furthermore, the calculation formula of the downsampling factor is:

[0086]

[0087] Among them, active(S T ) represents the time behavior sequence S in the time window T activity (such as call frequency), and c represents the adjustment parameter.

[0088] In fact, the time behavior sequence after downsampling is S′ T ={s t-T ,s t-T+k ,s t-T+2k ,…}, which retains the core features of behavioral data while significantly reducing the computational complexity.

[0089] Specifically, when executing step S2.3.3.3, it includes: inputting the downsampled time behavior sequence into the fast dynamic time warping algorithm, and performing similarity matching with the templates in the malicious behavior template library to obtain the matching distance.

[0090] Furthermore, the fast dynamic time warping algorithm calculates the global path at the coarse-grained level through hierarchical path optimization, and then makes local adjustments at the fine-grained level to quickly complete the calculation of the matching distance. The calculation formula of the matching distance is:

[0091] D(S′ T ,M n ) = FDWT(S′ T ,M n );

[0092] Among them, M n represents the nth malicious behavior template, D(S′ T ,M n ) is the time behavior sequence S′ T With template M n The matching distance.

[0093] In fact, multiple matching distances are calculated based on the malicious behavior template library, and the minimum matching distance is used to compare the abnormal threshold.

[0094] Specifically, when executing step S2.3.3.4, it includes: when the matching distance exceeds the preset abnormal threshold, the current behavior sequence is determined to be abnormal, and the process path is redirected to the bait file, otherwise the path is redirected to the real configuration file path.

[0095] In fact, the client is responsible for monitoring all access behaviors to the bait configuration files and reporting the access logs to the server. The server will also record and issue an alarm. The honeypot of the server-side collaborative module is responsible for capturing logins or other illegal access behaviors to the bait account, and generates a complete attack path analysis report based on the access logs, sending detailed alarm information to the user and informing him that the device may have been invaded.

[0096] Although the embodiments of the present invention are described in detail above, it is obvious to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as described in the claims. Moreover, the present invention described herein may have other embodiments and may be implemented or realized in a variety of ways.

Claims

1. A configuration file protection method based on dynamic redirection, characterized in that: The following steps are involved: Based on the system identifying the configuration file to be protected and transferring it to a secure storage location, a highly simulated decoy configuration file is generated in the original path of the configuration file to be protected based on the software and hardware characteristics of the user terminal device; Automatically capture the process that requests to access the configuration file to be protected based on the file system filter driver, and extract the key attributes of the process and pass them to the redirection decision engine, which determines the process that requests access based on blacklist and whitelist filtering rules, context environment detection, and behavior pattern analysis; When a request process is judged to be a legitimate behavior, the system will redirect the access path to the real configuration file. When it is judged to be an abnormal or suspicious request, the request process path will be redirected to the bait configuration file to induce the process to access forged data.

2. A configuration file protection method based on dynamic redirection according to claim 1, characterized in that: The process of identifying configuration files to be protected and transferring them to a secure storage location based on the system includes: When the system is run for the first time, it will automatically scan, identify and record all installed applications and software that support configuration file redirection. The scan results include software name, version information and default path of configuration files, and store the results in an encrypted database file. The system displays the scanning results to the user in the form of a list, outputs a prompt for the user to select a configuration file of the application to be protected, and transfers the extracted configuration file information to be protected to a secure storage area based on the user's selection.

3. A configuration file protection method based on dynamic redirection according to claim 2, characterized in that: The process of generating a highly simulated decoy configuration file in the original path of the configuration file to be protected based on the software and hardware characteristics of the user terminal device includes: According to the software and hardware characteristics of the user's terminal device, the usage pattern and access characteristics of the configuration file are analyzed, and the structural template of the real configuration file is used in combination with random parameters to generate a highly simulated bait file in the original path of the configuration file to be protected, and the bait account and password information are set for the account and password fields of the configuration file.

4. A configuration file protection method based on dynamic redirection according to claim 3, characterized in that: After the user selects the configuration file of the application to be protected, the server-side collaborative module will filter the honeypot that matches the selected program from the honeypot library based on the selected program and deploy it to the isolated server environment. The honeypot will focus on monitoring the set bait account and capture any attack activities that attempt to use the bait account for illegal access.

5. The configuration file protection method based on dynamic redirection according to claim 1, characterized in that: The process of automatically capturing the process requesting to access the configuration file to be protected based on the file system filter driver and extracting the key attributes of the process and passing them to the redirection decision engine includes: When a process initiates an access request and attempts to access the configuration file to be protected, the file system filter driver will automatically capture the request and interrupt the process to directly enter the file system; After capturing the access request, the filter driver extracts the key attributes of the request and passes them to the redirection decision engine. The key attributes include the target file path, the process ID that initiated the request, and the access mode.

6. The configuration file protection method based on dynamic redirection according to claim 1, characterized in that: The redirection decision engine determines the process of requesting access based on blacklist and whitelist filtering rules, context environment detection, and behavior pattern analysis, including: Obtaining a system whitelist and blacklist, wherein the whitelist contains authorized processes and the blacklist includes known malicious processes or software explicitly marked as a threat; The process requesting access is judged based on the blacklist and whitelist. When the process requesting access matches the whitelist rules, it is directly judged as trusted access and the path is redirected to the real configuration file path. When the process requesting access matches the blacklist rules, it is directly judged as untrusted access and the path is redirected to the bait file path. When the process requesting access matches neither the whitelist nor the blacklist, the process requesting access is judged based on context environment detection and behavior pattern analysis.

7. A configuration file protection method based on dynamic redirection according to claim 6, characterized in that: The process of judging the process requesting access based on context detection and behavior pattern analysis includes: Analyze the system context and process context, and map the system context and process context features into the scoring function for comprehensive evaluation, and obtain the abnormality score of the current system status and access behavior. When the score exceeds the threshold, the system determines that the current environment is abnormal, and marks the process requesting access as a potential threat, redirecting the path to the bait file path, otherwise the process requesting access is judged based on the behavior pattern analysis; The system context includes CPU occupancy, number of network connections, system running time, and user authority level; the process context environment includes the parent process chain of the initiating process, memory occupancy, number of threads and their behavior patterns.

8. A configuration file protection method based on dynamic redirection according to claim 7, characterized in that: The process of judging the process requesting access based on behavior pattern analysis includes: Based on a fixed time window defined by the system, historical behavior data of the process is extracted and a time behavior sequence is formed based on time sorting; The downsampling factor is calculated based on the activity of the time behavior series, and the behavior data of the time behavior series is sparsely processed based on the dynamic downsampling mechanism; The downsampled time behavior sequence is input into the fast dynamic time warping algorithm, and the similarity is matched with the templates in the malicious behavior template library to obtain the matching distance; When the matching distance exceeds a preset abnormal threshold, the current behavior sequence is determined to be abnormal, and the process path is redirected to the bait file, otherwise the path is redirected to the real configuration file path.

9. A configuration file protection method based on dynamic redirection according to claim 8, characterized in that: The process of extracting the historical behavior data of the process and forming a time behavior sequence based on time order includes: When the process is run for the first time or the historical behavior data is insufficient, the system will first refer to the behavior characteristics of the parent process to fill in the actual part; when the behavior data of the parent process is unavailable, the missing data will be inferred based on the known behavior characteristics through zero filling or neighboring interpolation, thereby ensuring the integrity of the time series and the accuracy of the analysis.

10. A configuration file protection method based on dynamic redirection according to claim 4, characterized in that: The client is responsible for monitoring all access behaviors to the bait configuration files and reporting the access logs to the server, which will record and issue an alarm. The honeypot of the server-side collaborative module is responsible for capturing logins or other illegal access behaviors to the bait accounts, and generates a complete attack path analysis report based on the access logs, sending detailed alarm information to users and informing them that the device may have been hacked.

Images