Data synchronization method and system based on honeypot service, terminal and medium

Abstract

The invention provides a data synchronization method and system based on honeypot service, a terminal and a medium. The method comprises the following steps: establishing an independent data storage space corresponding to honeypot equipment in a business system in advance; randomly generating corresponding false data according to a preset data template, and storing the false data in the independent data storage space; and synchronizing the target feature information of each real device in the business system to the honeypot device through the distributed data, and storing the target feature information in the independent data storage space. The randomly generated false data is highly similar to the real service environment, and the target feature information of each real device in the service system is synchronized to the honeypot device through the distributed data to simulate the device behavior in the real network environment and mislead an attacker, so that the attacker cannot identify the authenticity, the attack difficulty is improved, and the attack efficiency is improved. All data are stored in an independent data storage space, so that the honeypot equipment is completely isolated from real business data, and the safety of real equipment is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of honeypot services, and in particular to a data synchronization method, system, terminal and medium based on honeypot services. Background Art

[0002] Honeypot service is a network security technology that attracts attackers by simulating vulnerable hosts or services and capturing attack traffic and samples. The captured data is then used to analyze attack methods, discover network threats, and extract threat features, thereby enhancing network security protection capabilities.

[0003] However, in existing honeypot services, the data of honeypot devices and real devices are not synchronized, which makes it easy for attackers to identify real devices.

[0004] Therefore, the prior art has defects and needs to be improved and developed. Summary of the invention

[0005] The present application provides a data synchronization method, system, terminal and medium based on a honeypot service to solve the technical problem in the related art that the data of a honeypot device and a real device are not synchronized, and thus the real device can be easily identified by an attacker.

[0006] To achieve the above objectives, this application adopts the following technical solutions:

[0007] A data synchronization method based on a honeypot service, wherein the method comprises:

[0008] Pre-establish independent data storage space corresponding to the honeypot devices in the business system;

[0009] Randomly generate corresponding false data according to a preset data template, and store the false data in the independent data storage space;

[0010] The target feature information of each real device in the business system is synchronized to the honeypot device through distributed data, and the target feature information is stored in the independent data storage space.

[0011] According to the above-mentioned technical means, the embodiment of the present application utilizes preset data templates to randomly generate false data, which is highly similar to the real service environment, and synchronizes the target feature information of each real device in the business system to the honeypot device through distributed data, so as to simulate the device behavior in the real network environment, thereby misleading attackers, making it impossible for attackers to identify the authenticity and increasing the difficulty of the attack. All data are stored in an independent data storage space to ensure that the honeypot device is completely isolated from the real business data, thereby further improving the security of the real device.

[0012] In one embodiment of the present application, the target feature information includes: time, software and hardware features, network features and / or operation features of the real device.

[0013] According to the above technical means, the embodiments of the present application synchronize the time, software and hardware features, network features and operation features of the real device, so that the honeypot device can more realistically simulate the device behavior in the real network environment, which helps to attract attackers and makes it more difficult for them to distinguish the difference between the honeypot and the real device, thereby improving the effectiveness of the honeypot device. As bait, the honeypot device can attract the attention of attackers, thereby reducing the risk of real devices being attacked. By synchronizing the characteristic information of the real device, the honeypot device can more effectively simulate the real environment, making attackers more inclined to target the honeypot rather than the real device.

[0014] In one embodiment of the present application, the data template is obtained based on the service type simulated by the business system.

[0015] According to the above-mentioned technical means, in the embodiment of the present application, by using a data template designed based on the service type, the honeypot device can generate false data that is highly similar to the real service environment, which can attract attackers and make it more difficult for attackers to distinguish the difference between the honeypot and the real service; by using a data template based on the service type, the honeypot device can more effectively simulate the real service environment, making attackers more inclined to target the honeypot rather than the real system.

[0016] In one embodiment of the present application, after randomly generating corresponding false data according to a preset data template and storing the false data in the independent data storage space, the method further includes:

[0017] The false data is updated based on a preset data update strategy so that the false data in the honeypot device changes over time;

[0018] The updated false data is stored in the independent data storage space.

[0019] According to the above technical means, the embodiment of the present application uses a preset data update strategy to make the data in the honeypot change over time, thereby increasing its realism and preventing fixed data patterns from being easily identified.

[0020] In one embodiment of the present application, the data synchronization method based on the honeypot service further includes:

[0021] Pre-establish access permissions for honeypot devices;

[0022] When an access request is received, the access request is authenticated and authorized based on the access permission, and the access request and the authentication result are recorded.

[0023] According to the above-mentioned technical means, the embodiments of the present application can strictly control which users or systems can access the honeypot device by setting access rights, thereby preventing unauthorized access; the identity authentication and authorization mechanism ensures that only legitimate users or systems can access the data in the honeypot device, further enhancing the security of the system. The embodiments of the present application record access requests and identity authentication results to analyze access behaviors to the honeypot device. If abnormal access patterns or failed identity authentication attempts are found, this may indicate that a potential attacker is trying to infiltrate the honeypot device, thereby triggering a security response. By recording access requests, potential attack behaviors can be quickly located and analyzed, so that countermeasures can be taken more quickly, which helps to reduce the time attackers stay in the system and reduce the risk of data leakage or system damage.

[0024] In one embodiment of the present application, the data synchronization method based on the honeypot service further includes:

[0025] When malicious behavior is detected, respond based on pre-set specific trigger behavior response policies.

[0026] According to the above technical means, the embodiment of the present application can quickly trigger the preset response strategy by detecting malicious behavior, so as to defend and counterattack the attacker in time. This instant response mechanism helps to reduce the time the attacker stays in the system and reduce the risk of data leakage or system damage; the honeypot device, as a trap specially used to attract hacker attacks, can effectively entrap attackers and consume their time and resources, which helps to divert the attacker's attention from the real business system, thereby protecting the real system from attack. With the continuous advancement of attacker technology, honeypot devices also need to continuously update and improve their defense strategies. By presetting a variety of trigger behavior response strategies, honeypot devices can respond to various new attack methods more flexibly and improve the overall security of the system; through the preset trigger behavior response strategy, the false alarm and missed alarm rates can be further reduced, and the accuracy and reliability of the system can be improved.

[0027] In one embodiment of the present application, the data synchronization method based on the honeypot service further includes:

[0028] When a security threat event is detected, a pre-established protection measure strategy is searched to obtain a target protection measure corresponding to the security threat event;

[0029] Respond according to the targeted protection measures to protect the security of real devices.

[0030] According to the above technical means, the embodiment of the present application realizes data isolation and simulation through the characteristics of distributed data, ensuring that the honeypot device can both attract attackers and protect the security of real business data. When the honeypot device detects a security threat event, it can quickly find and apply the pre-established protection measures strategy, which helps to reduce the time the attacker stays in the system and reduce the risk of data leakage or system damage; the pre-established protection measures strategy is usually formulated based on known attack methods and vulnerabilities. When a security threat event matching these known attack methods is detected, the corresponding protection measures can be directly applied, thereby improving the defense efficiency; when a security threat event is detected, by finding the pre-established protection measures strategy, the attacker's intention and behavior pattern can be more accurately judged, thereby reducing the false positive and false negative rates; when a security threat event is detected, by applying the pre-established protection measures strategy, the attacker can be effectively guided to the honeypot device and prevented from further attacking the real device; by analyzing the execution effect of security threat events and protection measures strategies, the security strategy of the honeypot device can be continuously optimized and improved, thereby improving the overall security of the honeypot device and enabling it to better adapt to the ever-changing network security environment.

[0031] The present application also provides a data synchronization system based on a honeypot service, wherein the system comprises:

[0032] Establishing a module for pre-establishing independent data storage space corresponding to the honeypot device in the business system;

[0033] A storage module, used for randomly generating corresponding false data according to a preset data template, and storing the false data in the independent data storage space;

[0034] The synchronization module is used to synchronize the target feature information of each real device in the business system to the honeypot device through distributed data, and store the target feature information in the independent data storage space.

[0035] In one embodiment of the present application, the target feature information includes: time, software and hardware features, network features and / or operation features of the real device.

[0036] In one embodiment of the present application, the data template is obtained based on the service type simulated by the business system.

[0037] In one embodiment of the present application, the data synchronization system based on the honeypot service further includes:

[0038] An updating module, used for updating the false data based on a preset data updating strategy, so that the false data in the honeypot device changes over time;

[0039] The storage module is used to store the updated false data in the independent data storage space.

[0040] In one embodiment of the present application, the data synchronization system based on the honeypot service further includes:

[0041] The identity authentication module is used to pre-establish access rights corresponding to the honeypot device, and when receiving an access request, authenticate and authorize the access request based on the access rights, and record the access request and the identity authentication result.

[0042] In one embodiment of the present application, the data synchronization system based on the honeypot service further includes:

[0043] The response module is used to respond based on a pre-set specific trigger behavior response strategy when malicious behavior is detected.

[0044] In one embodiment of the present application, the data synchronization system based on the honeypot service further includes:

[0045] The search module is used to search for a pre-established protection measure strategy when a security threat event is detected, obtain the target protection measure corresponding to the security threat event, and respond according to the target protection measure to protect the security of the real device.

[0046] The present application also provides a terminal, which includes: a memory, a processor, and a data synchronization program based on a honeypot service stored in the memory and executable on the processor, wherein the data synchronization program based on the honeypot service, when executed by the processor, implements the steps of the data synchronization method based on the honeypot service as described above.

[0047] The present application also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program can be executed to implement the steps of the data synchronization method based on the honeypot service as described above.

[0048] The beneficial effects achieved by the present invention are:

[0049] First, the embodiment of the present application uses a preset data template to randomly generate false data, which is highly similar to the real service environment, and synchronizes the target feature information of each real device in the business system to the honeypot device through distributed data to simulate the device behavior in the real network environment, thereby misleading attackers and making it impossible for attackers to distinguish the authenticity, thereby increasing the difficulty of attack. All data is stored in an independent data storage space to ensure that the honeypot device is completely isolated from the real business data, thereby further improving the security of the real device.

[0050] Second, by using data templates designed based on service types, honeypot devices can generate false data that is highly similar to the real service environment, which can attract attackers and make it more difficult for attackers to distinguish between honeypots and real services. By using data templates based on service types, honeypot devices can more effectively simulate the real service environment, making attackers more inclined to target honeypots rather than real systems.

[0051] Third, through the characteristics of distributed data, data isolation and simulation are achieved to ensure that the honeypot device can both attract attackers and protect the security of real business data. When the honeypot device detects a security threat event, it can quickly find and apply the pre-established protection measures strategy, which helps to reduce the time the attacker stays in the system and reduce the risk of data leakage or system damage; the pre-established protection measures strategy is usually formulated based on known attack methods and vulnerabilities. When a security threat event matching these known attack methods is detected, the corresponding protection measures can be directly applied to improve defense efficiency; when a security threat event is detected, by finding the pre-established protection measures strategy, the attacker's intention and behavior pattern can be more accurately judged, thereby reducing the false positive and false negative rates; when a security threat event is detected, by applying the pre-established protection measures strategy, the attacker can be effectively guided to the honeypot device and prevented from further attacking the real device; by analyzing the execution effect of security threat events and protection measures strategies, the security strategy of the honeypot device can be continuously optimized and improved, thereby improving the overall security of the honeypot device and enabling it to better adapt to the ever-changing network security environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 It is a flow chart of a preferred embodiment of the data synchronization method based on honeypot service in the present invention.

[0053] Figure 2 It is a principle architecture diagram of the business system in the present invention.

[0054] Figure 3 It is a functional principle block diagram of a preferred embodiment of a data synchronization system based on honeypot service in the present invention.

[0055] Figure 4 It is a functional principle block diagram of a preferred embodiment of the terminal in the present invention. DETAILED DESCRIPTION

[0056] In order to make the purpose, technical solution and advantages of the present invention clearer and more specific, the present invention is further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0057] Honeypot service is a network security technology that attracts attackers by simulating vulnerable hosts or services and capturing attack traffic and samples. The captured data is then used to analyze attack methods, discover network threats, and extract threat features, thereby enhancing network security protection capabilities. Honeypot services usually set up one or more seemingly valuable vulnerabilities or flaws to induce attackers to attack. When attackers try to exploit these vulnerabilities, the honeypot will record all their activities, including the tools used, attack methods, attack time, etc. The recorded data is very valuable for analyzing the motivations and behavior patterns of attackers and can be used to optimize security policies.

[0058] The functions of the honeypot service include:

[0059] First, increase the cost of attack: by simulating fake targets to attract attackers, wasting their time and resources;

[0060] Second, capture attacker information: record all attacker activities, including the tools used, attack methods, etc., to provide valuable intelligence for the security team;

[0061] Third, reduce asset losses: by attracting attackers to reduce attacks on real systems, thereby reducing asset losses;

[0062] Fourth, improve security detection capabilities: provide more accurate attack identification capabilities, reduce false positives, and help security teams optimize security strategies.

[0063] That is, the role of the honeypot is to obtain the attacker's attack content for targeted defense and deceptive defense. Honeypot disguises include: sensitive information, business ports and other baits. Attackers judge whether it is a honeypot based on the following conditions: time difference, software and hardware difference, network difference and operation difference.

[0064] The following describes the data synchronization method, system, terminal and medium based on the honeypot service of the embodiment of the present application with reference to the accompanying drawings. In view of the problem that the data of the honeypot device and the real device in the related technology mentioned in the above background technology are not synchronized, and the real device is easily identified by the attacker, the present application provides a data synchronization method based on the honeypot service, in which an independent data storage space corresponding to the honeypot device in the business system is pre-established; the corresponding false data is randomly generated according to the preset data template, and the false data is stored in the independent data storage space; the target feature information of each real device in the business system is synchronized to the honeypot device through distributed data, and the target feature information is stored in the independent data storage space. The present application uses the preset data template to randomly generate false data, the false data is highly similar to the real service environment, and the target feature information of each real device in the business system is synchronized to the honeypot device through distributed data to simulate the device behavior in the real network environment, thereby misleading the attacker, making it impossible for the attacker to identify the authenticity, and increasing the difficulty of the attack. All data are stored in the independent data storage space to ensure that the honeypot device is completely isolated from the real business data, and further improve the security of the real device.

[0065] See also Figure 1 The data synchronization method based on the honeypot service described in the embodiment of the present invention comprises the following steps:

[0066] Step S100: pre-establish an independent data storage space corresponding to the honeypot device in the business system.

[0067] In order to ensure that attackers cannot obtain real business data, the embodiments of the present application combine the distributed data management capabilities and security policies of OpenHarmony (open source Hongmeng) to design data isolation and camouflage mechanisms. OpenHarmony's distributed database capabilities are the core of its distributed data management functions, providing applications with the ability to distribute and synchronize data between different devices. The distributed database system connects multiple physically dispersed database nodes through a network to form a logically unified database system. OpenHarmony's distributed database capabilities enable data to be distributed and stored on multiple devices and shared among these devices. Distributed databases provide transparent management of data, that is, users do not need to care about the specific storage location of the data, they only need to perform data operations through a unified interface, and support distributed transaction processing across devices to ensure data consistency and integrity. In the IoT scenario, OpenHarmony's distributed database capabilities can achieve data synchronization and sharing among multiple IoT devices, improving the efficiency of collaborative work of devices; in edge computing scenarios, distributed database capabilities can support data interaction and collaborative processing among multiple edge devices, improving the real-time and accuracy of data processing; in scenarios with harsh working environments and difficult communication networks, such as mines, ocean-going ships, and power tower construction, OpenHarmony's distributed database capabilities can achieve interconnection and data collaboration between devices without relying on specific network communication means.

[0068] The applications and services deployed in the honeypot environment in the embodiments of the present application use specially designed databases or data storage areas as independent data storage spaces. These storage areas only contain simulated or forged data, ensuring that the honeypot devices are completely isolated from real business data.

[0069] like Figure 1 As shown, the data synchronization method based on the honeypot service also includes the following steps:

[0070] Step S200: randomly generate corresponding false data according to a preset data template, and store the false data in the independent data storage space.

[0071] In the embodiment of the present application, the data template is obtained based on the service type simulated by the business system.

[0072] Specifically, service types include e-commerce services, banking services, and mail services. For example, the data templates for simulating e-commerce services include user information templates, transaction record templates, etc.; user information templates include user name (randomly generated), user ID (unique identifier), registration time (random time), delivery address (randomly generated but logical address), etc., and transaction record templates include order number (unique identifier), commodity name (randomly selected or preset), commodity quantity, commodity price, purchase time (random time), payment status (such as paid, unpaid, etc.). The data templates for simulating banking services include account information templates, transaction flow templates, etc.; account information templates include account name (randomly generated), account number (unique identifier), account type (such as savings card, credit card, etc.), account balance (random amount), account opening time (random time), etc., and transaction flow templates include transaction flow number (unique identifier), transaction time (random time), transaction type (such as transfer, deposit, withdrawal, etc.), transaction amount, counterparty account (randomly generated but logical account number), etc. The data templates for simulating email services include email information templates, attachment information templates, etc.; email information templates include sender (randomly generated or preset email address), recipient (randomly generated or preset email address), email subject (randomly generated but logical title), email body (randomly generated but logical text content), etc.; attachment information templates include attachment name (randomly generated but logical file name), attachment size (random size), attachment type (such as document, picture, video, etc.), etc.

[0073] By using a data template designed based on the service type, the embodiment of the present application enables the honeypot device to generate false data that is highly similar to the real service environment, which can attract attackers and make it more difficult for attackers to distinguish the difference between the honeypot and the real service; by using a data template based on the service type, the honeypot device can more effectively simulate the real service environment, making attackers more inclined to target the honeypot rather than the real system.

[0074] In one embodiment of the present application, the step S200 further includes: updating the false data based on a preset data update strategy so that the false data in the honeypot device changes over time; and storing the updated false data in the independent data storage space.

[0075] Specifically, the embodiment of the present application has developed a data camouflage mechanism that dynamically generates data that looks real but has no actual value based on the service type simulated by the honeypot. For example, user accounts, transaction records, etc. can be randomly generated, but it is ensured that these data have nothing to do with the real system. The camouflage mechanism will obtain distributed data, which appears to be normal business equipment (because it is synchronized from distributed data), but is actually forged. It can also obtain the attacker's detection logic, etc., and synchronize the detection logic to other normal devices. When other normal devices process the normal logic, they can return forged data.

[0076] In addition, the embodiments of the present application also utilize the inter-device communication capabilities of OpenHarmony to design a data update strategy so that the data in the honeypot changes over time, increasing its realism while preventing fixed data patterns from being easily identified.

[0077] The preset data update strategy in the embodiment of the present application includes updating the content, format and quantity of false data as time changes, and adjusting the false data accordingly according to the changes in real business data. The updated false data is also stored in an independent data storage space.

[0078] The embodiment of the present application uses a preset data update strategy to make the data in the honeypot change over time, thereby increasing its realism and preventing fixed data patterns from being easily identified.

[0079] like Figure 1 As shown, the data synchronization method based on the honeypot service also includes the following steps:

[0080] Step S300: synchronize the target feature information of each real device in the business system to the honeypot device through distributed data, and store the target feature information in the independent data storage space.

[0081] Specifically, the embodiment of the present application removes the business data through the distributed data capability of OpenHarmony, that is, the target feature information is the information from which the business data has been removed, and it has no effect even if the attacker obtains the target feature information of each real device.

[0082] In an embodiment of the present application, the target feature information includes: time, software and hardware features, network features and / or operation features of the real device.

[0083] Specifically, in the existing honeypot service, since the data of the honeypot device is not synchronized with the real device, it is easy for an attacker to determine whether the device is a honeypot device through time differences, software and hardware differences, network differences, and operation differences. Therefore, the embodiment of the present application synchronizes time differences, software and hardware differences, network differences, and operation differences, such as Figure 2As shown, device A is a honeypot device, and devices B, C, and D are real devices.

[0084] Software and hardware features include software features and hardware features. Software features include: operating system, application programs, drivers, etc.; operating systems such as Windows 10, macOS Big Sur, etc. provide basic computing operation functions and user interfaces; applications such as Microsoft Office suite, Adobe Photoshop, etc. are used to handle specific types of tasks, such as document editing, image processing, etc.; drivers such as graphics card drivers, printer drivers, etc. enable the operating system to communicate with hardware devices. Hardware features include: CPU model and performance, memory capacity, storage devices, network interfaces, etc.; CPU models and performance such as Intel Core i7 processors have specific performance indicators such as main frequency, number of cores and cache size; memory capacity such as 8GB DDR4 memory determines the system's ability to handle multiple tasks; storage devices such as 256GB SSD solid-state drives affect the system's startup speed and file reading and writing speed; network interfaces such as Gigabit Ethernet interfaces determine network transmission speeds.

[0085] Network characteristics include IP address, MAC address, network bandwidth, latency, network topology, etc. IP address is the unique network identifier of the device, used for communication in the network; MAC address is the identifier of the physical network interface, used for communication at the data link layer; network bandwidth, such as 100Mbps, 1Gbps, etc., determines the rate at which the network transmits data; latency refers to the time required for data to be transmitted in the network, which is affected by factors such as network congestion and device performance; network topology: the connection method between network devices, such as star, bus, ring, etc.

[0086] Operational characteristics include: user behavior, system processes, application behavior, security events, etc. User behaviors such as keyboard input, mouse clicks, file operations, etc. reflect the user's operating habits and intentions; system processes such as CPU usage and memory occupancy reflect the system's operating status and performance; application behaviors such as application startup, shutdown, data transmission, etc. are closely related to the application's functions and usage; security events such as virus scanning and firewall alarms reflect the system's security status.

[0087] By synchronizing the time, software and hardware features, network features, and operation features of real devices, the embodiments of the present application enable the honeypot device to more realistically simulate the device behavior in a real network environment, which helps to attract attackers and makes it more difficult for them to distinguish the difference between the honeypot and the real device, thereby improving the effectiveness of the honeypot device. As bait, the honeypot device can attract the attention of attackers, thereby reducing the risk of real devices being attacked. By synchronizing the feature information of real devices, the honeypot device can more effectively simulate the real environment, making attackers more inclined to target the honeypot rather than the real device.

[0088] In an embodiment of the present application, the data synchronization method based on the honeypot service also includes: pre-establishing access rights corresponding to the honeypot device; when an access request is received, authenticating and authorizing the access request based on the access rights, and at the same time, recording the access request and the authentication result.

[0089] Specifically, OpenHarmony's distributed data management capabilities are used to define independent data storage space and access rights for honeypot devices to ensure that the honeypot is completely isolated from real business data. This application also implements a strict access control policy to ensure that only the honeypot device itself can access the simulated data storage, and performs strict identity authentication and authorization on external requests. In addition, the embodiment of this application enables detailed audit logs to record all access attempts, including successful access attempts and failed access attempts, in order to analyze potential attack behaviors.

[0090] By setting access rights, the embodiments of the present application can strictly control which users or systems can access the honeypot device, thereby preventing unauthorized access; the identity authentication and authorization mechanism ensures that only legitimate users or systems can access the data in the honeypot device, further enhancing the security of the system. The embodiments of the present application record access requests and identity authentication results to analyze access behavior to the honeypot device. If abnormal access patterns or failed identity authentication attempts are found, this may indicate that a potential attacker is trying to infiltrate the honeypot device, thereby triggering a security response. By recording access requests, potential attack behaviors can be quickly located and analyzed, so that countermeasures can be taken more quickly, which helps to reduce the time attackers stay in the system and reduce the risk of data leakage or system damage.

[0091] In one embodiment of the present application, the data synchronization method based on the honeypot service further includes: when malicious behavior is detected, responding based on a preset specific trigger behavior response strategy.

[0092] Specifically, the honeypot device is designed to respond to specific trigger behaviors. For example, when malicious behavior is detected, strategies such as simulating system crashes and returning error information can be adopted to further confuse attackers.

[0093] By detecting malicious behavior, the embodiments of the present application can quickly trigger a preset response strategy, thereby timely defending and counterattacking the attacker. This immediate response mechanism helps to reduce the time the attacker stays in the system and reduce the risk of data leakage or system damage; the honeypot device, as a trap specifically designed to attract hacker attacks, can effectively entrap attackers and consume their time and resources, helping to divert the attacker's attention from the real business system, thereby protecting the real system from attack. As attackers' technology continues to advance, honeypot devices also need to continuously update and improve their defense strategies. By presetting a variety of trigger behavior response strategies, honeypot devices can respond to various new attack methods more flexibly and improve the overall security of the system; through the preset trigger behavior response strategy, the false alarm and missed alarm rates can be further reduced, and the accuracy and reliability of the system can be improved.

[0094] In one embodiment of the present application, the data synchronization method based on the honeypot service also includes: when a security threat event is detected, searching for a pre-established protection measure strategy to obtain a target protection measure corresponding to the security threat event; and responding according to the target protection measure to protect the security of the real device.

[0095] Specifically, the embodiment of the present application establishes an emergency response process. Once the honeypot device captures an important threat event, it will take prompt action to protect the real system security. Attackers cannot affect real business on the honeypot device. When the honeypot device obtains the attacker's attack content, it will synchronize the attacker's attack method to other devices, so that other devices can be well defended.

[0096] This application achieves data isolation and simulation by combining the distributed characteristics of OpenHarmony, ensuring that the honeypot device can both attract attackers and protect the security of real business data. When the honeypot device detects a security threat event, it can quickly find and apply the pre-established protection measures strategy, which helps to reduce the time the attacker stays in the system and reduce the risk of data leakage or system damage; the pre-established protection measures strategy is usually formulated based on known attack methods and vulnerabilities. When a security threat event matching these known attack methods is detected, the corresponding protection measures can be directly applied to improve the defense efficiency; when a security threat event is detected, by finding the pre-established protection measures strategy, the attacker's intention and behavior pattern can be more accurately judged, thereby reducing the false positive and false negative rates; when a security threat event is detected, by applying the pre-established protection measures strategy, the attacker can be effectively guided to the honeypot device and prevented from further attacking the real device; by analyzing the execution effect of security threat events and protection measures strategies, the security strategy can be continuously optimized and improved, thereby improving the overall security and enabling it to better adapt to the ever-changing network security environment.

[0097] In one embodiment, if Figure 3 As shown, based on the above-mentioned data synchronization method based on the honeypot service, the present invention also provides a data synchronization system based on the honeypot service, including:

[0098] Establishing module 100, used to pre-establish independent data storage space corresponding to the honeypot device in the business system;

[0099] The storage module 200 is used to randomly generate corresponding false data according to a preset data template, and store the false data in the independent data storage space;

[0100] The synchronization module 300 is used to synchronize the target feature information of each real device in the business system to the honeypot device through distributed data, and store the target feature information in the independent data storage space.

[0101] In one embodiment of the present application, the target feature information includes: time, software and hardware features, network features and / or operation features of the real device.

[0102] In one embodiment of the present application, the data template is obtained based on the service type simulated by the business system.

[0103] In one embodiment of the present application, the data synchronization system based on the honeypot service further includes:

[0104] An updating module, used for updating the false data based on a preset data updating strategy, so that the false data in the honeypot device changes over time;

[0105] The storage module is used to store the updated false data in the independent data storage space.

[0106] In one embodiment of the present application, the data synchronization system based on the honeypot service further includes:

[0107] The identity authentication module is used to pre-establish access rights corresponding to the honeypot device, and when receiving an access request, authenticate and authorize the access request based on the access rights, and record the access request and the identity authentication result.

[0108] In one embodiment of the present application, the data synchronization system based on the honeypot service further includes:

[0109] The response module is used to respond based on a pre-set specific trigger behavior response strategy when malicious behavior is detected.

[0110] In one embodiment of the present application, the data synchronization system based on the honeypot service further includes:

[0111] The search module is used to search for a pre-established protection measure strategy when a security threat event is detected, obtain the target protection measure corresponding to the security threat event, and respond according to the target protection measure to protect the security of the real device.

[0112] It should be noted that the aforementioned explanation of the embodiment of the data synchronization method based on the honeypot service is also applicable to the data synchronization system based on the honeypot service of this embodiment, and will not be repeated here.

[0113] The present invention discloses a data synchronization system based on honeypot service, which pre-establishes an independent data storage space corresponding to a honeypot device in a business system; randomly generates corresponding false data according to a preset data template, and stores the false data in the independent data storage space; synchronizes the target feature information of each real device in the business system to the honeypot device through distributed data, and stores the target feature information in the independent data storage space. The present application randomly generates false data using a preset data template, and the false data is highly similar to the real service environment, and synchronizes the target feature information of each real device in the business system to the honeypot device through distributed data, so as to simulate the device behavior in the real network environment, thereby misleading the attacker, making it impossible for the attacker to identify the authenticity, and increasing the difficulty of the attack. All data are stored in an independent data storage space, ensuring that the honeypot device is completely isolated from the real business data, and further improving the security of the real device.

[0114] Figure 4 A schematic diagram of the structure of a terminal provided in an embodiment of the present application. The terminal may include:

[0115] A memory 501 , a processor 502 , and a computer program stored in the memory 501 and executable on the processor 502 .

[0116] When the processor 502 executes the program, the data synchronization method based on the honeypot service provided in the above embodiment is implemented.

[0117] Furthermore, the terminal further includes:

[0118] The communication interface 503 is used for communication between the memory 501 and the processor 502 .

[0119] The memory 501 is used to store computer programs that can be executed on the processor 502 .

[0120] The memory 501 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0121] If the memory 501, the processor 502 and the communication interface 503 are implemented independently, the communication interface 503, the memory 501 and the processor 502 can be connected to each other through a bus and communicate with each other. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0122] Optionally, in a specific implementation, if the memory 501, the processor 502 and the communication interface 503 are integrated on a chip, the memory 501, the processor 502 and the communication interface 503 can communicate with each other through an internal interface.

[0123] The processor 502 may be a central processing unit (CPU), or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application.

[0124] This embodiment also provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the above-mentioned data synchronization method based on the honeypot service is implemented.

[0125] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or N embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0126] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include at least one of the features. In the description of this application, "N" means at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0127] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, fragment or portion of code comprising one or N executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present application includes additional implementations, in which the order shown or discussed may not be followed, including performing functions in a substantially simultaneous manner or in reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present application belong.

[0128] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by or in conjunction with an instruction execution system, system or device (such as a computer-based system, a system including a processor, or other system that can read instructions from an instruction execution system, system or device and execute the instructions). For the purposes of this specification, a "computer-readable medium" can be any system that can contain, store, communicate, propagate or transmit a program for use by or in conjunction with an instruction execution system, system or device. More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or N wirings (electronic systems), a portable computer disk case (magnetic systems), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic system, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically by optically scanning the paper or other medium and then editing, interpreting or otherwise processing in a suitable manner if necessary and then storing it in a computer memory.

[0129] It should be understood that the various parts of the present application can be implemented by hardware, software, firmware or a combination thereof. In the above embodiment, the N steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. If implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0130] A person skilled in the art may understand that all or part of the steps in the above-mentioned embodiment method may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0131] In addition, each functional unit in each embodiment of the present application may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0132] The storage medium mentioned above may be a read-only memory, a magnetic disk or an optical disk, etc. Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limiting the present application. A person of ordinary skill in the art may change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A data synchronization method based on honeypot service, characterized in that: The method comprises: Pre-establish independent data storage space corresponding to the honeypot devices in the business system; Randomly generate corresponding false data according to a preset data template, and store the false data in the independent data storage space; The target feature information of each real device in the business system is synchronized to the honeypot device through distributed data, and the target feature information is stored in the independent data storage space.

2. The data synchronization method based on honeypot service according to claim 1, characterized in that: The target characteristic information includes: time, software and hardware characteristics, network characteristics and / or operation characteristics of the real device.

3. The data synchronization method based on honeypot service according to claim 1, characterized in that: The data template is obtained based on the service type simulated by the business system.

4. The data synchronization method based on honeypot service according to claim 1, characterized in that: After randomly generating corresponding false data according to a preset data template and storing the false data in the independent data storage space, the method further includes: The false data is updated based on a preset data update strategy so that the false data in the honeypot device changes over time; The updated false data is stored in the independent data storage space.

5. The data synchronization method based on honeypot service according to claim 1, characterized in that: The data synchronization method based on the honeypot service also includes: Pre-establish access permissions for honeypot devices; When an access request is received, the access request is authenticated and authorized based on the access permission, and the access request and the authentication result are recorded.

6. The data synchronization method based on honeypot service according to claim 1, characterized in that: The data synchronization method based on the honeypot service also includes: When malicious behavior is detected, respond based on pre-set specific trigger behavior response policies.

7. The data synchronization method based on honeypot service according to claim 1, characterized in that: The data synchronization method based on the honeypot service also includes: When a security threat event is detected, a pre-established protection measure strategy is searched to obtain a target protection measure corresponding to the security threat event; Respond according to the targeted protection measures to protect the security of real devices.

8. A data synchronization system based on honeypot service, characterized in that: The system comprises: Establishing a module for pre-establishing independent data storage space corresponding to the honeypot device in the business system; A storage module, used for randomly generating corresponding false data according to a preset data template, and storing the false data in the independent data storage space; The synchronization module is used to synchronize the target feature information of each real device in the business system to the honeypot device through distributed data, and store the target feature information in the independent data storage space.

9. A terminal, characterized in that: include: A memory, a processor, and a data synchronization program based on a honeypot service stored in the memory and executable on the processor, wherein the data synchronization program based on the honeypot service, when executed by the processor, implements the steps of the data synchronization method based on the honeypot service as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program can be executed to implement the steps of the data synchronization method based on the honeypot service as claimed in any one of claims 1 to 7.

Images