Deception defense method and device based on honeypot technology and medium

Abstract

The invention provides a cheating defense method and device based on a honeypot technology and a medium, and the method comprises the steps: guiding an attacker to enter a honeynet environment when an attack behavior is detected; in response to an attacker entering the honeynet environment, forming an attack chain model based on a preset threat intelligence library according to an attack behavior of the attacker, and continuously evolving and optimizing the attack chain model according to the behavior of the attacker to ensure that the attack chain model is kept effective; the effective attack chain model is subjected to virtual verification of the honeynet environment, in the virtual verification process, different types of honeypot nodes cooperate to form a deep defense stage, and a response action with the highest rationality is executed on an attack behavior. According to the method, the device and the medium, the problems that most of the existing cheat defense methods based on the honeypot technology focus on the enhancement of the simulation degree of the methods, the methods are easy to be broken, the interaction between the honeypot and the attack behavior cannot be improved, and the effects in the aspects of hysteresis attack and capture attack are limited can be solved.

Description

Technical Field

[0001] The present invention relates to the field of active defense technology, and in particular to a deception defense method, device and medium based on honeypot technology. Background Art

[0002] Lateral movement in the intranet is a key stage in a network attack, usually after the attacker has successfully entered the target network and obtained initial access rights. At this stage, the attacker aims to expand their access rights in the target network horizontally to obtain more sensitive information, control more systems, or carry out deeper attacks. Since a large amount of sensitive information and assets are gathered in the intranet environment, it is more likely to become a target of attack. Therefore, strengthening the intranet defense system is crucial to protecting network assets. Deception defense technology is a threat detection technology with deceptive nature based on the application of honeypots, virtual systems, virtual networks and other methods. It is currently receiving widespread attention in the field of active defense of network security. Network deception aims to deceive attackers after they have infiltrated the network through some exploitable false vulnerabilities and forged information that can be stolen, attracting attackers to access the wrong system resources to establish reliable interactions. Honeypots are a specific implementation of deception defense technology. Honeynet is a network composed of multiple honeypots. Compared with a single honeypot, it has a larger scale and complexity, and can provide more comprehensive attack information and more continuous deception responses.

[0003] Most of the existing deception defense methods based on honeypot technology focus on enhancing its own simulation. For example, enhancing the authenticity of the honeypot operating system, application programs and their own vulnerabilities to match the existing business model. However, the enhancement method that only focuses on the honeypot's own simulation is very easy to be detected during the interaction with the attacker, and has limited effect on improving the interactivity between the honeypot and the attack behavior, thereby delaying and capturing the attack. Summary of the invention

[0004] The technical problem to be solved by the present invention is to provide a deception defense method, device and medium based on honeypot technology in response to the above-mentioned deficiencies in the prior art, so as to solve the problems that the existing deception defense methods based on honeypot technology mostly focus on enhancing their own simulation degree, are easily detected, cannot improve the interactivity between honeypots and attack behaviors, and have limited effects in delaying attacks and capturing attacks.

[0005] In a first aspect, the present invention provides a deception defense method based on honeypot technology, the method comprising:

[0006] When an attack is detected, the attacker is guided into the honeynet environment;

[0007] In response to an attacker entering the honeynet environment, an attack chain model is formed based on the attacker's attack behavior and a preset threat intelligence library, and the attack chain model is continuously evolved and optimized according to the attacker's behavior to ensure that the attack chain model remains effective;

[0008] The effective attack chain model is used for virtual verification in the honeynet environment. During the virtual verification process, different types of honeypot nodes cooperate with each other to form a defense-in-depth stage, and the most reasonable response action is performed on the attack behavior. Among them, the most reasonable response action refers to guiding the attacker to perform deep interaction through matching the effective attack chain model to maximize the interaction frequency.

[0009] Furthermore, when an attack behavior is detected, guiding the attacker into the honeynet environment specifically includes:

[0010] When an attack is detected, the attacker is redirected into the predefined honeynet environment through the Internet Protocol IP redirection proxy technology, so that the attacker deviates from his attack path and accesses the pre-configured honeypot nodes one by one.

[0011] Furthermore, the attack chain model is formed based on the preset threat intelligence library according to the attack behavior of the attacker, specifically including:

[0012] Extract threat keywords from the attack behavior;

[0013] Matching the threat keyword with known attack events in the threat intelligence library to identify a key attack phrase that best matches the threat keyword;

[0014] Extracting an attack probability set according to the best matching key attack phrase, wherein the attack probability set includes different advanced attack behaviors and their corresponding occurrence probabilities;

[0015] Map the extracted threat keywords to the ATT&CK threat model to complete the attack behavior feature extraction;

[0016] The attack chain model is constructed based on a preset probability model and the extracted attack behavior characteristics and the attack probability set.

[0017] Furthermore, the types of honeypot nodes include early warning honeypots, recording honeypots and countermeasure honeypots. The early warning honeypot is deployed at the edge of the network. When attacked, the early warning honeypot will immediately communicate with adjacent nodes to alert attack-related information; the recording honeypot is deployed inside the network to record attack behavior information; the countermeasure honeypot is deployed in the core of the network to capture more attack information.

[0018] Furthermore, the response action with the highest rationality includes at least one of the following: the service has been successfully called, the identity authentication has been passed, the login is successful, the content is copied successfully, the content data is obtained, the phishing link is accepted and clicked, the service is successfully utilized, the required software already exists, the software is deployed / transferred successfully, and the remote service permission is obtained.

[0019] Furthermore, the method further comprises:

[0020] According to the attacker's continuously iterative attack behavior chain and the actual network environment of the honeypot node, a dynamic strategy for the honeypot response is formed, and the execution of subsequent actions is determined according to the response situation.

[0021] Furthermore, the method further comprises:

[0022] Through the response of the dynamic strategy, the corresponding attack information is obtained, and the attacker is traced back and a portrait of the attacker is drawn based on the acquired attack information, thereby completing the tracing and countermeasures against the attacker.

[0023] In a second aspect, the present invention provides a deception defense device based on honeypot technology, the device comprising:

[0024] Honeynet guidance module, used to guide the attacker into the honeynet environment when an attack behavior is detected;

[0025] An attack chain model forming module, connected to the honeynet guiding module, for responding to an attacker entering the honeynet environment, forming an attack chain model based on the attacker's attack behavior and a preset threat intelligence library, and continuously evolving and optimizing the attack chain model according to the attacker's behavior to ensure that the attack chain model remains effective;

[0026] The deception defense module is connected to the attack chain model module, and is used to perform virtual verification of the effective attack chain model in the honeynet environment. During the virtual verification process, different types of honeypot nodes cooperate to form a depth defense stage, and perform the most reasonable response action to the attack behavior, wherein the most reasonable response action refers to guiding the attacker to perform deep interaction through matching the effective attack chain model to maximize the interaction frequency.

[0027] In a third aspect, the present invention provides a deception defense device based on honeypot technology, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to implement the deception defense method based on honeypot technology described in the first aspect.

[0028] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the deception defense method based on the honeypot technology described in the first aspect is implemented.

[0029] The present invention provides a deception defense method, device and medium based on honeypot technology. When an attack behavior is detected, the attacker is first guided into the honeynet environment; then, in response to the attacker entering the honeynet environment, an attack chain model is formed based on the attacker's attack behavior and a preset threat intelligence library, and the attack chain model is continuously evolved and optimized according to the attacker's behavior to ensure that the attack chain model remains effective; then the effective attack chain model is subjected to virtual verification of the honeynet environment, and during the virtual verification process, different types of honeypot nodes cooperate to form a defense-in-depth stage, and the most reasonable response action is executed to the attack behavior, wherein the most reasonable response action refers to guiding the attacker to interact deeply through matching the effective attack chain model to maximize the interaction frequency. The present invention focuses on improving the interactivity between honeypots and attack behaviors. By dynamically constructing an attack chain model and continuously optimizing it according to the attacker's behavior, it is possible to identify and execute the most reasonable response actions in the honeynet environment. These actions are not only based on the precise matching of the attack chain model, but also through the coordinated operations of different types of honeypot nodes in the honeynet environment, forming a defense in depth, guiding the attacker to interact deeply, and maximizing the interaction frequency. It not only significantly improves the interactivity between the honeypot and the attack behavior, but also can trap more attack features and behavior strategies by extending the attack behavior chain in the honeypot. It solves the problem that the existing deception defense methods based on honeypot technology mostly focus on the enhancement of their own simulation degree, are easily detected, cannot improve the interactivity between the honeypot and the attack behavior, and have limited effects in delaying attacks and capturing attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 This is a flow chart of a deception defense method based on honeypot technology according to Embodiment 1 of the present invention;

[0031] Figure 2 This is a flow chart of another deception defense method based on honeypot technology according to Embodiment 1 of the present invention;

[0032] Figure 3 This is a schematic diagram of the structure of a deception defense device based on honeypot technology according to Embodiment 2 of the present invention;

[0033] Figure 4 This is a schematic diagram of the structure of a deception defense device based on honeypot technology according to Example 3 of the present invention. DETAILED DESCRIPTION

[0034] In order to enable those skilled in the art to better understand the technical solution of the present invention, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0035] It should be understood that the specific embodiments and drawings described herein are only used to explain the present invention rather than to limit the present invention.

[0036] It can be understood that, in the absence of conflict, the various embodiments of the present invention and the various features in the embodiments can be combined with each other.

[0037] It can be understood that, for the convenience of description, the drawings of the present invention only show the parts related to the present invention, while the parts irrelevant to the present invention are not shown in the drawings.

[0038] It can be understood that each unit and module involved in the embodiments of the present invention may correspond to only one physical structure, or may be composed of multiple physical structures, or multiple units and modules may be integrated into one physical structure.

[0039] It can be understood that the terms "first", "second", etc. in the embodiments of the present invention are used to distinguish different objects, or to distinguish different processing of the same object, rather than to describe a specific order of objects.

[0040] It can be understood that, without conflict, the functions and steps marked in the flowcharts and block diagrams of the present invention may occur in an order different from that marked in the drawings.

[0041] It is understood that the flowcharts and block diagrams of the present invention illustrate the possible architectures, functions, and operations of the systems, devices, equipment, and methods according to the various embodiments of the present invention. Each box in the flowchart or block diagram may represent a unit, module, program segment, or code, which contains executable instructions for implementing the specified functions. Moreover, each box or combination of boxes in the block diagram and flowchart may be implemented by a hardware-based system that implements the specified functions, or may be implemented by a combination of hardware and computer instructions.

[0042] It can be understood that the units and modules involved in the embodiments of the present invention can be implemented by software or hardware. For example, the units and modules can be located in a processor.

[0043] Embodiment 1:

[0044] This embodiment provides a deception defense method based on honeypot technology, such as Figure 1 As shown, the method includes:

[0045] Step S101: When an attack behavior is detected, guide the attacker into a honeynet environment.

[0046] In this embodiment, an attacker enters the intranet environment from the external Internet through the firewall, and the attack behavior is detected at this time. When the attack behavior is detected, the attacker is guided into the honeynet environment. If a normal user accesses the enterprise intranet, it is determined that it is not an attack behavior, and the attacker can access the enterprise intranet normally.

[0047] Optionally, when an attack behavior is detected, guiding the attacker into a honeynet environment specifically includes:

[0048] When an attack is detected, the attacker is redirected into the predefined honeynet environment through IP (Internet Protocol) redirection proxy technology, so that the attacker deviates from his attack path and accesses the pre-configured honeypot nodes one by one.

[0049] In this embodiment, based on the existing real network production environment as a reference, a large number of deceptive false targets and misleading information can be deployed for the mapping of different areas in the actual intranet and the basic host nodes and system services to generate experimental honeypot environments with different complexities. When an attack is detected, the attack is guided into a customized honeynet environment through IP redirection proxy technology, so that the attacker deviates from his attack path and accesses the pre-configured honeypot nodes one by one (even if the attacker changes the original attack target or direction and enters the honeynet environment).

[0050] Step S102: In response to an attacker entering the honeynet environment, an attack chain model is formed according to the attacker's attack behavior based on a preset threat intelligence library, and the attack chain model is continuously evolved and optimized according to the attacker's behavior to ensure that the attack chain model remains effective.

[0051] In this embodiment, the threat intelligence library includes: malware samples, event descriptions, technical and non-technical information of attackers and intelligence. The threat intelligence library can be established using an open source threat intelligence platform, such as OpenCTI, or it can be built by the organization itself, such as the Weibu Threat Intelligence Center. When an attacker enters the honeynet environment, an attack chain model is formed based on the attacker's attack behavior and the preset threat intelligence library. After a period of verification and adjustment, if the attack chain model can stably simulate the attacker's behavior and successfully predict its possible next move, it will be confirmed as a valid attack chain model.

[0052] Optionally, forming an attack chain model based on a preset threat intelligence library according to the attacker's attack behavior specifically includes:

[0053] Extract threat keywords from the attack behavior;

[0054] Matching the threat keyword with known attack events in the threat intelligence library to identify a key attack phrase that best matches the threat keyword;

[0055] Extracting an attack probability set according to the best matching key attack phrase, wherein the attack probability set includes different advanced attack behaviors and their corresponding occurrence probabilities;

[0056] Map the extracted threat keywords to the ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) threat model to complete the attack behavior feature extraction;

[0057] The attack chain model is constructed based on a preset probability model and the extracted attack behavior characteristics and the attack probability set.

[0058] In this embodiment, the threat keywords can be tools, techniques, vulnerability names, attack stage identifiers, etc. used by attackers. The extracted threat keywords, such as event descriptions, attack types, etc., are used to simply describe and understand the attack behavior. The extracted threat keywords are matched with known attack events in the threat intelligence library. This step is to identify the known attack events that are most similar to the current attack behavior, so as to obtain more detailed attack information and context. Through matching, the key attack phrases that best match the threat keywords are found, and then according to the best matching key attack phrases, the attack probability set is extracted. This set contains the behaviors of different advanced attacks (i.e., attack steps or stages) and their corresponding occurrence probabilities. The extracted threat keywords are mapped to the ATT&CK threat model. Through mapping, the extraction of attack behavior features can be completed. Among them, ATT&CK is a framework developed by MITRE for describing and classifying tactics, techniques, and processes in network attacks. This helps to understand the attacker's behavior pattern more comprehensively. Finally, the attack chain model is constructed based on the preset probability model and the extracted attack behavior features and attack probability set, wherein the probability model can be, for example, HMM (Hidden Markov Model).

[0059] Step S103: The effective attack chain model is subjected to virtual verification in the honeynet environment. During the virtual verification process, different types of honeypot nodes cooperate with each other to form a defense-in-depth stage, and perform the most reasonable response action to the attack behavior, wherein the most reasonable response action refers to guiding the attacker to perform deep interaction through matching the effective attack chain model to maximize the interaction frequency.

[0060] In this embodiment, virtual verification of the honeynet environment refers to the process of verifying the attack chain model in the honeynet environment. During the virtual verification process, different types of honeypot nodes form three in-depth defense stages in the intranet, namely threat warning, information collection, and source tracing and countermeasure, and cooperate to perform the most reasonable response actions to the attack behaviors. Among them, the most reasonable response action is to guide the attacker to do deep interaction through matching the above-mentioned effective attack chain model to maximize the interaction frequency.

[0061] Specifically, the attacked honeypot node executes the most reasonable response action according to the threat intelligence library model, in order to maximize the interaction frequency between the attacker and the defender, expose more attack features, and complete the deception defense more efficiently. Among them, the threat intelligence library model is a model built based on machine learning or deep learning technology that can process and analyze a large amount of threat intelligence data. This model not only contains the data in the traditional threat intelligence library, but also can use algorithms and models to automatically extract, associate, analyze and predict threat information. Through training and optimization, the threat intelligence library model can more intelligently identify and analyze attack behaviors, and provide more accurate and timely response actions (or response strategies) for network security defense.

[0062] Optionally, the types of honeypot nodes include early warning honeypots, recording honeypots and countermeasure honeypots. The early warning honeypot is deployed at the edge of the network. When attacked, the early warning honeypot will immediately communicate with adjacent nodes to alert attack-related information; the recording honeypot is deployed inside the network to record attack behavior information; the countermeasure honeypot is deployed in the core of the network to capture more attack information.

[0063] In this embodiment, the early warning honeypot is deployed at the edge of the network. When attacked, it will immediately communicate with adjacent nodes to warn of attack-related information; the recording honeypot is deployed inside the network to record attack behavior information to support further research and analysis. The counterattack honeypot is deployed at the core of the network to capture more attack information, that is, it focuses on capturing in-depth information about attack behavior.

[0064] Optionally, the response action with the highest rationality includes at least one of the following: service has been successfully called, identity authentication has passed, login is successful, content copying is successful, content data is obtained, phishing link is accepted and clicked, service utilization is successful, required software already exists, software deployment / transfer is successful, and remote service permissions are obtained.

[0065] In this embodiment, the most reasonable response actions that each honeypot node can choose include: successful service call, identity authentication passed, successful login, successful content copying, acquisition of content data, acceptance and clicking on phishing links, successful service utilization, required software already exists, successful software deployment / transfer, acquisition of remote service permissions, etc.

[0066] Optionally, the method further comprises:

[0067] According to the attacker's continuously iterative attack behavior chain and the actual network environment of the honeypot node, a dynamic strategy for the honeypot response is formed, and the execution of subsequent actions is determined according to the response situation.

[0068] In this embodiment, according to the attacker's continuously iterative attack behavior chain, combined with the actual network environment of the honeypot node, a dynamic strategy for the honeypot response is formed, and the execution of subsequent actions is determined according to the response situation. In the attack and defense interaction, the honeypot decides on the behavior based on the response strategy, improves its own concealment and confusion through efficient and reasonable attack response, further delays and captures the attack behavior, and continuously adjusts its response strategy according to the state observation and feedback of the next time step.

[0069] Optionally, the method further comprises:

[0070] Through the response of the dynamic strategy, the corresponding attack information is obtained, and the attacker is traced back and a portrait of the attacker is drawn based on the acquired attack information, thereby completing the tracing and countermeasures against the attacker.

[0071] In this embodiment, after obtaining sufficient attack information through the dynamic policy response of the honeypot, the attack behavior is further analyzed by linking the floating code to the attack end, tracing the attacker and drawing a portrait of the attacker, and completing the tracing and countermeasures against the attacker. Among them, the attacker information expected to be traced usually includes the attacker's identity, behavior, tools and techniques used, and attack purpose.

[0072] It should be noted that the deception defense method based on honeypot technology provided by the present invention studies the correlation characteristics of attack behaviors from the perspective of attack-defense interaction and iterative game, reasonably models the attack behaviors, trains the honeypot in the interaction to generate high-interaction response strategies through learning, effectively improves the interactivity between attack and defense, and extends the behavior chain of attacks in the honeypot, thereby capturing more attack characteristics and behavior strategies.

[0073] In a specific embodiment, Figure 2 As shown, the deception defense method based on honeypot technology may include the following steps:

[0074] Step 1: Build a dynamic honeynet, based on the existing real network production environment, deploy a large number of deceptive false targets and misleading information for the mapping of different areas in the actual intranet and basic host nodes and system services, and generate experimental honeypot environments with different complexities.

[0075] Step 2: The attacker enters the intranet environment from the external Internet through the firewall. At this time, the IP redirection proxy technology is used to guide the attack behavior into the customized honeynet environment, causing the attacker to deviate from his attack path and access the pre-configured honeypot nodes one by one.

[0076] Among them, if a normal user accesses the enterprise intranet, it is determined that it is not an attack behavior, and the user can access the enterprise intranet normally.

[0077] Step 3: After the attacker enters the honeynet environment, the threat intelligence library is matched according to the characteristics of the attack behavior and path. According to the best matching degree, the attack probability set is extracted to form an attack chain model, and the effective attack chain model is continuously and dynamically evolved according to the attacker's behavior.

[0078] The threat intelligence library includes malware samples, event descriptions, technical and non-technical information about attackers and intelligence. The threat intelligence library can be built using open source threat intelligence platforms, such as OpenCTI, or it can be built by the organization itself, such as the Weibu Threat Intelligence Center.

[0079] Specifically, by extracting threat keywords from attack behaviors, such as event descriptions, attack types, etc., simply describe and understand attack behaviors, extract key attack phrases from attack event descriptions in threat intelligence, perform threat similarity calculations on threat keywords, determine the calculation similarity results, and the highest score is the best match. According to the best match, the extracted attack probability set is the behaviors a1, a2, a3, etc. of different advanced attacks, and the corresponding occurrence probabilities p1, p2, p3, etc. The attack chain model, after extracting keywords from the attack behavior, maps and refers to the ATT&CK threat model to complete the attack behavior feature extraction, and refers to a probability model, such as HMM (Hidden Markov Model), to build an attack chain model. Then, according to the attacker's behavior, the effective attack chain model is continuously and dynamically evolved, that is, the attack chain model shows the path that the attacker has already attacked, and also includes the predicted path that the attacker may attack next. In this way, a dynamic attack chain model and a dynamic attack probability set can be realized.

[0080] Step 4: Use the effective attack chain model to conduct virtual verification in the honeynet environment, and reasonably configure the network topology environment of the vulnerability according to parameters such as environment complexity and attack chain length.

[0081] Among them, the effective attack chain model refers to the attack probability set, that is, the candidate attack chain set, which is verified by interacting with the network environment configured with vulnerability information to obtain the effective attack chain model.

[0082] Among them, virtual verification of the honeynet environment refers to the process of building a virtual honeynet environment, establishing a honeynet environment including protocol simulation, port simulation, process simulation, etc., and verifying the attack chain model or security policy in the honeynet environment.

[0083] Step 5: Different types of honeypot nodes form three defense-in-depth stages in the intranet: threat warning, information collection, and source tracing and countermeasures. They work together to respond to attack behaviors. Early warning honeypots are deployed at the edge of the network. When attacked, they will immediately communicate with adjacent nodes to warn of attack-related information. Recording honeypots are deployed inside the network to record attack behavior information and support further research and analysis. Countermeasure honeypots are deployed at the core of the network to capture more attack information.

[0084] Specifically, the types of honeypot nodes include early warning honeypots, recording honeypots, and countermeasure honeypots. If the honeypot where the current attacker is located is an early warning honeypot, the honeypot will communicate with adjacent nodes to warn of attack-related information. If the honeypot where the current attacker is located is a recording honeypot, the honeypot will record the attack behavior information to support further research and analysis. If the honeypot where the current attacker is located is a countermeasure honeypot, more attack information will be captured.

[0085] Step 6: The attacked honeypot node executes the most reasonable response action (response strategy) based on the threat intelligence library model, in order to maximize the interaction frequency between attack and defense, expose more attack features, and complete deception defense more efficiently.

[0086] Among them, each honeypot node can choose the most reasonable response action as shown in Table 1:

[0087] Table 1: The most reasonable response actions that can be selected by honeypot nodes

[0088]

[0089] It should be noted that the honeypot is a fake network bait environment. The most reasonable response action is to guide the attacker to have deep interaction and maximize the interaction frequency by matching the above-mentioned effective attack chain model.

[0090] Step 7: Based on the attacker's iterative attack behavior chain and the actual network environment of the honeypot node, a dynamic strategy for the honeypot response is formed, and the execution of subsequent actions is determined based on the response situation. In the attack and defense interaction, the honeypot decides on the behavior based on the response strategy, improves its own concealment and confusion through efficient and reasonable attack response, further delays and captures the attack behavior, and continuously adjusts its response strategy based on the state observation and feedback of the next time step.

[0091] Among them, a series of response actions constitute a response strategy.

[0092] Step 8: After obtaining sufficient attack information through the dynamic policy response of the above honeypot, further analyze the attack behavior by linking the floating code to the attack end, trace the attacker and draw a portrait of the attacker, and complete the tracing and countermeasures against the attacker.

[0093] The attacker information that is expected to be traced usually includes the attacker's identity, behavior, tools and techniques used, and attack purpose.

[0094] It should be noted that the high-interaction honeypot strategy can interact with attackers who attempt to enter the intranet and move laterally through active and reasonable responses, thereby effectively improving its own concealment and achieving effective delay and capture of attack behaviors. The more times the honeypot interacts with the attacker, and the more the interactive response pattern conforms to the attack behavior, the more efficient deception defense can be achieved. The present invention can guide the attacker to interact deeply, maximize the interaction frequency, expose more attack features, and thus complete deception defense more efficiently.

[0095] The deception defense method based on honeypot technology provided in an embodiment of the present invention first guides the attacker into the honeynet environment when an attack behavior is detected; then, in response to the attacker entering the honeynet environment, an attack chain model is formed based on the attacker's attack behavior and a preset threat intelligence library, and the attack chain model is continuously evolved and optimized according to the attacker's behavior to ensure that the attack chain model remains effective; then the effective attack chain model is subjected to virtual verification in the honeynet environment, and during the virtual verification process, different types of honeypot nodes cooperate to form a defense-in-depth stage, and execute the most reasonable response action to the attack behavior, wherein the most reasonable response action refers to guiding the attacker to perform deep interaction through matching of the effective attack chain model to maximize the interaction frequency. The present invention focuses on improving the interactivity between honeypots and attack behaviors. By dynamically constructing an attack chain model and continuously optimizing it according to the attacker's behavior, it is possible to identify and execute the most reasonable response actions in the honeynet environment. These actions are not only based on the precise matching of the attack chain model, but also through the coordinated operations of different types of honeypot nodes in the honeynet environment, forming a defense in depth, guiding the attacker to interact deeply, and maximizing the interaction frequency. It not only significantly improves the interactivity between the honeypot and the attack behavior, but also can trap more attack features and behavior strategies by extending the attack behavior chain in the honeypot. It solves the problem that the existing deception defense methods based on honeypot technology mostly focus on the enhancement of their own simulation degree, are easily detected, cannot improve the interactivity between the honeypot and the attack behavior, and have limited effects in delaying attacks and capturing attacks.

[0096] Embodiment 2:

[0097] like Figure 3 As shown, this embodiment provides a deception defense device based on honeypot technology, which is used to execute the deception defense method based on honeypot technology, including:

[0098] A honeynet guiding module 11 is used to guide the attacker into the honeynet environment when an attack behavior is detected;

[0099] The attack chain model forming module 12 is connected to the honeynet guiding module 11, and is used to respond to an attacker entering the honeynet environment, form an attack chain model based on the attacker's attack behavior and a preset threat intelligence library, and continuously evolve and optimize the attack chain model according to the attacker's behavior to ensure that the attack chain model remains effective;

[0100] The deception defense module 13 is connected to the attack chain model forming module 12, and is used to perform virtual verification of the effective attack chain model in the honeynet environment. During the virtual verification process, different types of honeypot nodes cooperate to form a depth defense stage, and perform the most reasonable response action to the attack behavior, wherein the most reasonable response action refers to guiding the attacker to perform deep interaction through matching the effective attack chain model to maximize the interaction frequency.

[0101] Optionally, the honeynet guiding module 11 is specifically used for:

[0102] When an attack is detected, the attacker is redirected into the predefined honeynet environment through the Internet Protocol IP redirection proxy technology, so that the attacker deviates from his attack path and accesses the pre-configured honeypot nodes one by one.

[0103] Optionally, the attack chain model forming module 12 includes:

[0104] A threat keyword extraction unit, used to extract threat keywords from the attack behavior;

[0105] A threat keyword matching unit, used to match the threat keyword with known attack events in the threat intelligence library, and identify a key attack phrase that best matches the threat keyword;

[0106] An attack probability set extraction unit, configured to extract an attack probability set according to the best matching key attack phrase, wherein the attack probability set includes different advanced attack behaviors and their corresponding occurrence probabilities;

[0107] The attack behavior feature extraction unit is used to map the extracted threat keywords to the adversarial tactics, techniques, and common sense ATT&CK threat model to complete the attack behavior feature extraction;

[0108] An attack chain model building unit is used to build the attack chain model based on a preset probability model and the extracted attack behavior characteristics and the attack probability set.

[0109] Optionally, the types of honeypot nodes include early warning honeypots, recording honeypots and countermeasure honeypots. The early warning honeypot is deployed at the edge of the network. When attacked, the early warning honeypot will immediately communicate with adjacent nodes to alert attack-related information; the recording honeypot is deployed inside the network to record attack behavior information; the countermeasure honeypot is deployed in the core of the network to capture more attack information.

[0110] Optionally, the response action with the highest rationality includes at least one of the following: service has been successfully called, identity authentication has passed, login is successful, content copying is successful, content data is obtained, phishing link is accepted and clicked, service utilization is successful, required software already exists, software deployment / transfer is successful, and remote service permissions are obtained.

[0111] Optionally, the device further comprises:

[0112] The dynamic strategy forming module is used to form a dynamic strategy for honeypot response according to the attacker's continuously iterative attack behavior chain and the actual network environment of the honeypot node, and determine the execution of subsequent actions according to the response situation.

[0113] Optionally, the device further comprises:

[0114] The source tracing and countermeasure module is used to obtain corresponding attack information through the response of the dynamic strategy, and trace the attacker and draw a portrait of the attacker based on the acquired attack information to complete the source tracing and countermeasure against the attacker.

[0115] Embodiment 3:

[0116] refer to Figure 4 This embodiment provides a deception defense device based on honeypot technology, including a memory 21 and a processor 22. The memory 21 stores a computer program, and the processor 22 is configured to run the computer program to execute the deception defense method based on honeypot technology in Example 1.

[0117] The memory 21 is connected to the processor 22. The memory 21 may be a flash memory, a read-only memory or other memory. The processor 22 may be a central processing unit or a single-chip microcomputer.

[0118] Embodiment 4:

[0119] This embodiment provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the deception defense method based on the honeypot technology in the above-mentioned embodiment 1 is implemented.

[0120] The computer-readable storage medium includes volatile or non-volatile, removable or non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, computer program modules or other data). Computer-readable storage media include, but are not limited to, RAM (Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable read only memory), flash memory or other memory technology, CD-ROM (Compact Disc Read-Only Memory), digital versatile disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer.

[0121] In summary, the deception defense method, device and medium based on honeypot technology provided by the embodiments of the present invention first guide the attacker into the honeynet environment when an attack behavior is detected; then, in response to the attacker entering the honeynet environment, an attack chain model is formed based on the attacker's attack behavior and a preset threat intelligence library, and the attack chain model is continuously evolved and optimized according to the attacker's behavior to ensure that the attack chain model remains effective; then the effective attack chain model is subjected to virtual verification of the honeynet environment. During the virtual verification process, different types of honeypot nodes cooperate to form a defense-in-depth stage, and the most reasonable response action is executed to the attack behavior, wherein the most reasonable response action refers to guiding the attacker to perform deep interaction through matching of the effective attack chain model to maximize the interaction frequency. The present invention focuses on improving the interactivity between honeypots and attack behaviors. By dynamically constructing an attack chain model and continuously optimizing it according to the attacker's behavior, it is possible to identify and execute the most reasonable response actions in the honeynet environment. These actions are not only based on the precise matching of the attack chain model, but also through the coordinated operations of different types of honeypot nodes in the honeynet environment, forming a defense in depth, guiding the attacker to interact deeply, and maximizing the interaction frequency. It not only significantly improves the interactivity between the honeypot and the attack behavior, but also can trap more attack features and behavior strategies by extending the attack behavior chain in the honeypot. It solves the problem that the existing deception defense methods based on honeypot technology mostly focus on the enhancement of their own simulation degree, are easily detected, cannot improve the interactivity between the honeypot and the attack behavior, and have limited effects in delaying attacks and capturing attacks.

[0122] It is to be understood that the above embodiments are merely exemplary embodiments used to illustrate the principles of the present invention, but the present invention is not limited thereto. For those of ordinary skill in the art, various modifications and improvements can be made without departing from the spirit and essence of the present invention, and these modifications and improvements are also considered to be within the scope of protection of the present invention.

Claims

1. A deception defense method based on honeypot technology, characterized in that: The method comprises: When an attack is detected, the attacker is guided into the honeynet environment; In response to an attacker entering the honeynet environment, an attack chain model is formed based on the attacker's attack behavior and a preset threat intelligence library, and the attack chain model is continuously evolved and optimized according to the attacker's behavior to ensure that the attack chain model remains effective; The effective attack chain model is used for virtual verification in the honeynet environment. During the virtual verification process, different types of honeypot nodes cooperate with each other to form a defense-in-depth stage, and the most reasonable response action is performed on the attack behavior. Among them, the most reasonable response action refers to guiding the attacker to perform deep interaction through matching the effective attack chain model to maximize the interaction frequency.

2. The method according to claim 1, characterized in that: When an attack behavior is detected, guiding the attacker into the honeynet environment specifically includes: When an attack is detected, the attacker is redirected into the predefined honeynet environment through the Internet Protocol IP redirection proxy technology, so that the attacker deviates from his attack path and accesses the pre-configured honeypot nodes one by one.

3. The method according to claim 1, characterized in that: The attack chain model is formed based on the attack behavior of the attacker and a preset threat intelligence library, specifically including: Extract threat keywords from the attack behavior; Matching the threat keyword with known attack events in the threat intelligence library to identify a key attack phrase that best matches the threat keyword; Extracting an attack probability set according to the best matching key attack phrase, wherein the attack probability set includes different advanced attack behaviors and their corresponding occurrence probabilities; Map the extracted threat keywords to the ATT&CK threat model to complete the attack behavior feature extraction; The attack chain model is constructed based on a preset probability model and the extracted attack behavior characteristics and the attack probability set.

4. The method according to claim 1, characterized in that The types of honeypot nodes include early warning honeypots, recording honeypots and countermeasure honeypots. The early warning honeypot is deployed at the edge of the network. When attacked, the early warning honeypot will immediately communicate with adjacent nodes to alert attack-related information; the recording honeypot is deployed inside the network to record attack behavior information; the countermeasure honeypot is deployed in the core of the network to capture more attack information.

5. The method according to claim 1, characterized in that: The response actions with the highest rationality include at least one of the following: the service has been successfully called, the identity authentication has been passed, the login is successful, the content is copied successfully, the content data is obtained, the phishing link is accepted and clicked, the service is successfully utilized, the required software already exists, the software is deployed / transferred successfully, and the remote service permission is obtained.

6. The method according to claim 5, characterized in that The method further comprises: According to the attacker's continuously iterative attack behavior chain and the actual network environment of the honeypot node, a dynamic strategy for the honeypot response is formed, and the execution of subsequent actions is determined according to the response situation.

7. The method according to claim 6, characterized in that The method further comprises: Through the response of the dynamic strategy, the corresponding attack information is obtained, and the attacker is traced back and a portrait of the attacker is drawn based on the acquired attack information, thereby completing the tracing and countermeasures against the attacker.

8. A deception defense device based on honeypot technology, characterized in that: The device comprises: Honeynet guidance module, used to guide the attacker into the honeynet environment when an attack behavior is detected; An attack chain model forming module, connected to the honeynet guiding module, for responding to an attacker entering the honeynet environment, forming an attack chain model based on the attacker's attack behavior and a preset threat intelligence library, and continuously evolving and optimizing the attack chain model according to the attacker's behavior to ensure that the attack chain model remains effective; The deception defense module is connected to the attack chain model module, and is used to perform virtual verification of the effective attack chain model in the honeynet environment. During the virtual verification process, different types of honeypot nodes cooperate to form a depth defense stage, and perform the most reasonable response action to the attack behavior, wherein the most reasonable response action refers to guiding the attacker to perform deep interaction through matching the effective attack chain model to maximize the interaction frequency.

9. A deception defense device based on honeypot technology, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to implement the deception defense method based on the honeypot technology as claimed in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the deception defense method based on the honeypot technology as described in any one of claims 1 to 7 is implemented.

Images