A gpt-based high-interaction honey point design method and system
By using a GPT-based honeypot design method, simulating a network interface and utilizing GPT to respond to attack commands, the problem of honeypot systems being unable to respond effectively is solved. This achieves low-cost, high-fidelity attack response and reduces deployment and maintenance difficulty.
Patent Information
- Application Number
- CN202510231072.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2025-02-28
- Publication Date
- 2025-10-17
- Estimated Expiration
- 2045-02-28
AI Technical Summary
Existing honeypot systems are unable to effectively respond to attacker commands, have high deployment costs, and pose security risks.
We employ a high-interaction honeypot design method based on GPT, using web crawlers to collect front-end network scenarios and service information, simulating vulnerable services and eliminating internal system calls, utilizing GPT for natural language processing and response, and combining historical database analysis to analyze attack intent and generate simulated responses.
Significantly reduces honeypot deployment costs, minimizes security risks, improves response simulation accuracy, and reduces maintenance difficulty and resource consumption.
Smart Images
Figure CN119996025B_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The application relates to the technical field of large model security analysis, in particular to a GPT-based high-interaction honeypot design method and system. BACKGROUND
[0002] In recent years, active deception defense, as a security strategy, has been increasingly widely applied. Compared with traditional network security measures, active deception defense aims to protect networks and systems by misleading attackers. This method involves creating fake network resources, such as fake servers, services, and data. These resources are designed to appear valuable to attackers, luring them into a controlled environment, while in fact these resources are traps used by security teams to monitor and analyze attacker behavior. The key advantage of active deception defense is that it not only detects attacks, but also collects intelligence about attackers' methods, techniques, and intentions. This information is very valuable for strengthening defense measures, preventing future attacks, and understanding attackers' motives.
[0003] Currently, the main product of active deception defense is a honeypot. The principle of a commercial high-interaction honeypot is to simulate real services and interact with attackers, thereby attracting attackers and collecting their attack behavior data. However, this type of design method has high deployment overhead and there is a risk of honeypot escape.
[0004] A honeypot is a virtual decoy device based on traditional honeypots that directly interacts with attackers. The honeypot is deployed in the same external network segment as the real assets of an enterprise to attract attackers to interact with it. Attackers will be induced to enter the honeypot and perform similar operations and interactions with real systems, thereby exposing their attack behavior. Since the deployment cost of the honeypot is low, it is currently unable to effectively respond to attack payloads of attackers.
[0005] Therefore, there is an urgent need to develop a solution to solve the above problems. SUMMARY
[0006] The purpose of the present application is to provide a GPT-based high-interaction honeypot design method and system, which improves the inability of the honeypot to effectively respond to attack instructions.
[0007] The GPT-based high-interaction honeypot design method provided by the present application adopts the following technical solution:
[0008] Analyze the network of the scene to be deployed, crawl the network front-end scene and service information based on network crawler technology, simulate the scene network interface based on the network front-end scene and service information, and deploy services with vulnerabilities, modify the shell program pointed to by the services with vulnerabilities to a GPT interaction program, remove the internal system call program of the services, encapsulate the interface and the services into a Docker container, and deploy the Docker container to a honeypot host;
[0009] Based on the honey point host receiving the attack data of the attacker, the illegal instructions and malicious payloads in the attack data are identified based on a natural language processing pattern matching algorithm, and a corresponding error signal is returned. The attack instructions are recorded and combined with the historical attack database to analyze the intention of the attacker to obtain an analysis result;
[0010] Based on the analysis result, a pre-designed prompt word template is embedded and input into a GPT response terminal. A RAG algorithm based on maximum approximate search is used to search the instruction database and generate response content. The attack instructions are responded to based on the response content, and the current attack instructions and response results are stored in the historical attack database.
[0011] Optionally, based on the network front-end scene and service information, a scene network is simulated and a vulnerable service is deployed, including:
[0012] The network front-end scene is crawled through network crawler technology, the scene network to be deployed is highly simulated on the interface, and the service information of the network is crawled. Based on the service information, a vulnerable service version is found from a vulnerability library, and the vulnerable service is deployed. The service has complete input and output and system call process.
[0013] Optionally, in the process of eliminating the service internal system call program, the function modules directly interacting with the native system are removed, including file reading and writing, instruction transmission, and only the communication functions required for user interface and interaction with the attacker are retained.
[0014] Optionally, the illegal instructions and malicious payloads in the attack data are identified based on a natural language processing pattern matching algorithm, and a corresponding error signal is returned, including:
[0015] Based on the natural language processing pattern matching method, the instructions that do not conform to the linux syntax in the current attack data are identified. An error signal is returned to the GPT response terminal for the instructions that cannot be identified. The GPT response terminal sends the error information to the attacker after receiving the error signal;
[0016] After the correct instructions are screened out, the instructions are further analyzed by GPT to screen whether there are malicious payloads. When GPT analyzes the malicious payloads, an error signal is returned to the GPT response terminal based on the version information of the current service and the host information of the current simulation host. Based on the error signal, the GPT response terminal assists in responding.
[0017] Optionally, in the process of recording the attack instructions and combining the historical attack database to analyze the intention of the attacker to obtain an analysis result, including:
[0018] When receiving the attack instruction of the attacker, the attack instruction is recorded and stored in a historical attack database, the attack instruction is analyzed in real time based on a GPT analysis terminal and accumulated historical attack data, and the behavior mode and attack intention of the attacker are obtained.
[0019] Optionally, the process of embedding the pre-designed prompt word template into the GPT response terminal based on the analysis result comprises:
[0020] The received attack data is analyzed in detail, the key behavior characteristics and context information are extracted, and the behavior characteristics, context information and pre-designed prompt word template are combined based on the behavior mode and attack intention of the attacker to form a complete prompt word, and the prompt word is input into the GPT response terminal.
[0021] Optionally, the process of searching the instruction database and generating the response content based on the RAG algorithm of maximum approximate search comprises:
[0022] The input instruction of the attacker is analyzed in detail, the key elements and intention are extracted, the instruction vector database is searched based on the RAG algorithm of maximum approximate search to find the existing instruction and response mode closest to the key elements and intention, and the final response content is generated based on the best matching result, combined with the information of the current service environment and the simulation host.
[0023] In a second aspect of the application, a GPT-based high-interactive honeypot design system is provided, comprising a service simulator module, a GPT analysis terminal module and a GPT response terminal module, wherein:
[0024] The service simulator module is configured to analyze the network to be deployed scene, crawl the network front-end scene and service information based on the network crawler technology, simulate the scene network interface based on the network front-end scene and service information and deploy the service with vulnerabilities, modify the shell program pointed by the service with vulnerabilities to the GPT interactive program, remove the service internal system call program, encapsulate the interface and service into a Docker container and deploy to the honeypot host.
[0025] The GPT analysis terminal module is configured to receive the attack data of the attacker based on the honeypot host, identify the illegal instruction and malicious payload in the attack data based on the natural language processing mode matching algorithm, and return the corresponding error signal, record the attack instruction and analyze the intention of the attacker to obtain the analysis result.
[0026] The GPT response terminal module is configured to input a pre-designed prompt word template based on an analysis result into a GPT response terminal, search an instruction database based on a RAG algorithm of maximum approximate search and generate a response content, respond to an attack instruction based on the response content, and store the current attack instruction and the response result into the historical attack database.
[0027] The GPT-based high-interactive honeypot design method and system provided by the application have the beneficial effects that: the powerful natural language processing and understanding generalization capability of GPT are utilized, the front-end honeypot is only used for interface display, the back-end server deploying GPT completes autonomous response, the deployment cost of the honeypot is significantly reduced, only the front-end interface and data forwarding need to be simulated in the deployment process, and resource consumption is small; and since the vulnerabilities in the honeypot are exploited, the attack data transmitted will not be actually executed, but simulated response is performed by the large language model terminal, since all the vulnerabilities in the honeypot are simulated, the security risk is significantly reduced; the GPT analysis terminal is designed, malicious data threatening the GPT response terminal is removed, the high simulation of the GPT response terminal in the response process is ensured, and the attacker is greatly avoided; in the deployment and maintenance process, the pages and data transmission of the deployed service are mainly simulated, the response and response feedback are implemented by the server deploying GPT, and the deployment difficulty and maintenance cost are greatly reduced. BRIEF DESCRIPTION OF DRAWINGS
[0028] Figure 1 A GPT-based high-interactive honeypot design method flowchart is provided for the application.
[0029] Figure 2 A GPT-based high-interactive honeypot design method example diagram is provided for the application. DETAILED DESCRIPTION
[0030] To make the objectives, technical solutions, and advantages of the embodiments of the application clearer, the technical solutions in the embodiments of the application will be described clearly and completely below. Obviously, the described embodiments are some, but not all, of the embodiments of the application. Based on the embodiments in the application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the application. Unless otherwise defined, the technical terms or scientific terms used herein should have the meanings commonly understood by those of ordinary skill in the art. The similar words such as “comprise” used herein mean that the elements or objects before the words cover the elements or objects listed after the words and their equivalents, and other elements or objects are not excluded.
[0031] The GPT-based high-interactive honeypot design method provided by the embodiments of the application, as shown in Figure 1 , comprises:
[0032] S1, analyze the network to be deployed scene, based on network crawler technology crawling network front-end scene and service information, based on the network front-end scene and service information simulation scene network interface and deploy the service with vulnerabilities, the shell program pointed to the service with vulnerabilities is modified to GPT interactive program, the internal system call program of the service is removed, the interface and the service are packaged into a Docker container and deployed to a honeypot host;
[0033] S2, based on the honeypot host receiving attack data of the attacker, based on the natural language processing mode matching algorithm to identify illegal instructions and malicious payloads in the attack data, and return the corresponding error signal, record the attack instructions and analyze the intention of the attacker combined with the historical attack database to get the analysis result;
[0034] S3, based on the analysis result, embed the pre-designed prompt word template into the GPT response terminal, based on the RAG algorithm of maximum approximate search to find the instruction database and generate response content, based on the response content to respond to the attack instruction, and store the current attack instruction and response result into the historical attack database.
[0035] In some embodiments, in the process of performing step S1, it includes:
[0036] S1.1, analyze the network to be deployed scene;
[0037] S1.2, based on network crawler technology crawling network front-end scene and service information;
[0038] S1.3, based on the network front-end scene and service information simulation scene network interface and deploy the service with vulnerabilities;
[0039] S1.4, the shell program pointed to the service with vulnerabilities is modified to GPT interactive program;
[0040] S1.5, remove the internal system call program of the service, package the interface and the service into a Docker container and deploy to a honeypot host.
[0041] Specifically, in the process of performing step S1.1, analyzing the network to be deployed scene, it includes: clearly defining the deployment target and demand: obtaining the specific business supported by the scene network, determining the scale of terminal user access to the network, and the area covered by the network.
[0042] Further, in the process of performing step S1.2, based on the network crawler technology crawling network front-end scene and service information, based on the browser's developer tools to analyze the HTML structure, CSS style and JavaScript code of the target network front-end scene and service information, and based on the website structure, write a crawler script to store the crawled data.
[0043] Specifically, in step S1.3, the network front-end scene and service information are simulated to deploy a vulnerable service, including:
[0044] The network front-end scene is crawled through a web crawler technology, the to-be-deployed scene network is highly simulated on an interface, and service information of the network is crawled. Based on the service information, a vulnerable service version is found from a vulnerability library, and the vulnerable service is deployed. The service has complete input and output and a system call process.
[0045] Specifically, in step S1.4, the shell program pointed to by the vulnerable service is modified into a GPT interactive program, including: determining input information received by the GPT model, integrating an API of the GPT, and modifying the shell program pointed to by the service into a new GPT interactive program.
[0046] In fact, the GPT interactive program is responsible for receiving input instructions of the attacker and communicating with a GPT response terminal deployed in the backend, so as to realize a simulated response to the input of the attacker without actually executing any system command or operation. This step ensures that even if the attacker tries to exploit the vulnerability in the service, no actual damage will be caused to the honeypot host.
[0047] Specifically, in step S1.5, the internal system call program of the service is removed, the interface and the service are packaged into a Docker container, and the Docker container is deployed to the honeypot host, including: going deep into the service to remove function modules that directly interact with the local system, including file reading and writing, instruction transmission, and only retaining a user interface and communication functions required for interaction with the attacker, and packaging the interface and the service into a Docker container and deploying the Docker container to the honeypot host.
[0048] In fact, by removing the internal system call program of the service, packaging the interface and the service into a Docker container, and deploying the Docker container to the honeypot host, not only can the security risk of the honeypot host caused by the attack on the service be avoided, but also resource overhead can be reduced.
[0049] In some embodiments, in step S2, the process includes:
[0050] S2.1, receiving attack data of the attacker based on the honeypot host;
[0051] S2.2, identifying illegal instructions and malicious payloads in the attack data based on a natural language processing pattern matching algorithm, and returning corresponding error signals;
[0052] S2.3, recording the attack instructions and analyzing the intentions of the attacker to obtain an analysis result in combination with a historical attack database.
[0053] Specifically, in the process of executing step S2.2, it includes:
[0054] Based on the natural language processing pattern matching method, the instructions that do not conform to the linux syntax in the current attack data are identified, and an error signal is returned to the GPT response terminal for the instructions that cannot be identified. The GPT response terminal sends error information to the attacker after receiving the error signal;
[0055] After screening the correct instructions, the instructions are further analyzed by GPT to screen whether there is malicious payload. When GPT analyzes the malicious payload, it will return an error signal to the GPT response terminal based on the version information of the current service and the host information of the current simulation host. Based on the error signal, the GPT response terminal assists the GPT response terminal to respond.
[0056] Specifically, in the process of executing step S2.3, it includes:
[0057] When receiving the attack instruction of the attacker, record the attack instruction and store it in the historical attack database. Based on the GPT analysis terminal and the accumulated historical attack data, the attack instruction is analyzed in real time to obtain the behavior pattern and attack intention of the attacker.
[0058] In some embodiments, in the process of executing step S3, it includes:
[0059] S3.1, based on the analysis result, a pre-designed prompt word template is input into the GPT response terminal;
[0060] S3.2, based on the RAG algorithm of maximum approximate search, the instruction database is searched and the response content is generated;
[0061] S3.3, based on the response result, the attack instruction is responded.
[0062] Specifically, in the process of executing step S3.1, based on the analysis result, a pre-designed prompt word template is input into the GPT response terminal, which includes:
[0063] The received attack data is analyzed in detail, the key behavior characteristics and context information are extracted, and the behavior characteristics, context information and pre-designed prompt word template are combined based on the behavior pattern and attack intention of the attacker to form a complete prompt word. The prompt word is input into the GPT response terminal.
[0064] In fact, the prompt word template contains specific context information for different types of attack instructions, ensuring that the GPT response terminal can generate highly simulated and realistic simulation response content, and by inputting the constructed prompt word into the GPT response terminal, the powerful natural language processing ability of the GPT response terminal is used to generate the final response, while ensuring the consistency and coherence of the context during the entire process, thereby improving the deception effect on the attacker.
[0065] Specifically, in the process of executing step S3.2, the RAG algorithm based on maximum approximation search searches the instruction database and generates response content, including:
[0066] The input instruction of the attacker is analyzed in detail, and the key elements and intentions are extracted, and the RAG algorithm based on maximum approximation search is used to find the closest existing instructions and response patterns in the instruction vector database based on the key elements and intentions, and based on the best matching result, the current service environment and the information of the simulation host are combined to generate the final response content.
[0067] In fact, the instruction database contains the instructions of common operating systems, services and attack tools and their corresponding response examples, and the matching by the maximum approximation search method not only considers the specific content of the attack instruction, but also combines historical attack records and context information to ensure that the generated response has high authenticity and consistency.
[0068] Further, in step S3.3, the generated response content is fed back to the attacker through the GPT response terminal, and stored in the historical attack database for subsequent analysis and improvement, thereby improving the deception ability and security of the honeypot system.
[0069] In other embodiments, referring to Figure 2 , including:
[0070] Based on the service simulator to simulate the network front-end scene and service information and deploy to the honeypot host, based on the honeypot host to receive the attack data of the attacker, the attack data is transmitted to the GPT analysis terminal to obtain the analysis result and return to the user, the GPT response terminal generates false response content based on the data interacted by the GPT analysis terminal, and returns the response content to the honeypot host, and responds to the attacker based on the response content.
[0071] The embodiment of the application provides a high-interactive honeypot design system based on GPT, which comprises a service simulator module, a GPT analysis terminal module and a GPT response terminal module, wherein:
[0072] The service simulator module is configured to analyze a network to be deployed scene, crawl network front-end scene and service information based on a network crawler technology, simulate a scene network interface based on the network front-end scene and service information and deploy a service with a vulnerability, modify a shell program pointed by the service with the vulnerability to a GPT interactive program, eliminate a service internal system call program, encapsulate an interface and the service into a Docker container and deploy to a honeypot host;
[0073] The GPT analysis terminal module is configured to receive attack data of an attacker based on the honeypot host, identify illegal instructions and malicious payloads in the attack data based on a natural language processing pattern matching algorithm, and return a corresponding error signal, record attack instructions and analyze an intention of the attacker to obtain an analysis result in combination with a historical attack database;
[0074] The GPT response terminal module is configured to input a pre-designed prompt word template into a GPT response terminal based on the analysis result, search an instruction database based on a maximum approximate search RAG algorithm and generate response content, respond to attack instructions based on the response content, and store the current attack instructions and response results into the historical attack database.
[0075] Although the embodiments of the present application have been described in detail above, it is obvious to those skilled in the art that various modifications and changes can be made to the embodiments. However, it should be understood that such modifications and changes are within the scope and spirit of the present application as described in the claims. Moreover, the present application described herein can have other embodiments and can be implemented or realized in various ways.
Claims
1. A high-interaction honey spot design method based on GPT, characterized in that: include: Analyze the network of the scenario to be deployed, crawl the network front-end scenario and service information based on web crawler technology, simulate the scenario network interface based on the network front-end scenario and service information, and deploy the vulnerable service. Modify the shell program pointed to by the vulnerable service to a GPT interactive program, remove the service's internal system call program, encapsulate the interface and service into a Docker container, and deploy it to the honeypot host; The honeypot host receives the attacker's attack data, identifies illegal commands and malicious payloads in the attack data based on the natural language processing pattern matching algorithm, and returns the corresponding error signal. The attack commands are recorded and analyzed in combination with the historical attack database to obtain the analysis results; Based on the analysis results, a pre-designed prompt word template is embedded and input into the GPT response terminal. The RAG algorithm based on maximum approximation search searches the instruction database and generates response content. Based on the response content, a response is made to the attack instruction, and the current attack instruction and response result are stored in the historical attack database.
2. The GPT-based high-interaction honeyspot design method according to claim 1, characterized in that: Based on the network front-end scenario and service information, simulate the scenario network and deploy vulnerable services, including: The network front-end scene is crawled through web crawler technology, the network of the scene to be deployed is highly simulated on the interface, and the service information of the network is crawled. Based on the service information, the service version with vulnerabilities is found from the vulnerability library, and the service with vulnerabilities is deployed. The service has complete input and output and system call processes.
3. The high-interaction honeyspot design method based on GPT according to claim 1, characterized in that: The process of removing the system call program within the service includes: going deep into the service and removing the functional modules that directly interact with the local system, including those involving file reading and writing, and instruction transmission, and only retaining the user interface and the communication functions required to interact with the attacker.
4. The GPT-based high-interaction honeyspot design method according to claim 1, characterized in that: Identify illegal instructions and malicious payloads in attack data based on natural language processing pattern matching algorithms and return corresponding error signals, including: Based on natural language processing pattern matching, it identifies commands in the current attack data that do not conform to Linux syntax. For commands that cannot be identified, it returns an error signal to the GPT response terminal. After receiving the error signal, the GPT response terminal sends the error information to the attacker. After filtering out the correct instructions, the instructions are further analyzed by GPT to screen whether there are malicious payloads. When GPT analyzes malicious payloads, it will combine the version information of the current service and the host information of the current simulated host to return an error signal to the GPT response terminal, and assist the GPT response terminal in responding based on the error signal.
5. The high-interaction honeyspot design method based on GPT according to claim 1, characterized in that: The process of recording attack commands and analyzing the attacker's intentions in combination with the historical attack database to obtain analysis results includes: When an attack instruction from an attacker is received, the attack instruction is recorded and stored in the historical attack database. The attack instruction is analyzed in real time based on the GPT analysis terminal and the accumulated historical attack data to obtain the attacker's behavior pattern and attack intention.
6. The GPT-based high-interaction honeyspot design method according to claim 5, characterized in that: The process of embedding the pre-designed prompt word template based on the analysis results into the GPT response terminal includes: The received attack data is analyzed in detail to extract key behavioral features and contextual information. Based on the attacker's behavioral patterns and attack intentions, the behavioral features and contextual information are combined with a pre-designed prompt word template to form a complete prompt word, which is then input into the GPT response terminal.
7. The GPT-based high-interaction honeyspot design method according to claim 1, characterized in that: The process of searching the instruction database and generating response content using the RAG algorithm based on maximum approximation search includes: The attacker's input instructions are analyzed in detail to extract the key elements and intentions. The RAG algorithm based on maximum approximation search searches the instruction vector database to find the existing instructions and response patterns that are closest to the key elements and intentions. Based on the best matching result found, combined with the current service environment and information of the simulated host, the final response content is generated.
8. A high-interaction honey spot design system based on GPT, characterized by: It includes service simulator module, GPT analysis terminal module and GPT response terminal module, among which: Service simulator module: configured to analyze the network of the scenario to be deployed, crawl the network front-end scenario and service information based on web crawler technology, simulate the scenario network interface based on the network front-end scenario and service information and deploy the vulnerable service, modify the shell program pointed to by the vulnerable service to the GPT interactive program, remove the service internal system call program, encapsulate the interface and service into Docker containers and deploy them to the honeypot host; GPT analysis terminal module: This module is configured to receive attack data from attackers based on a honeypot host, identify illegal commands and malicious payloads in the attack data using a natural language processing pattern matching algorithm, and return corresponding error signals. It also records the attack commands and analyzes the attacker's intent in conjunction with a historical attack database to obtain analysis results. GPT response terminal module: configured to embed a pre-designed prompt word template based on the analysis results and input it into the GPT response terminal, search the instruction database based on the RAG algorithm of maximum approximation search and generate response content, respond to the attack instruction based on the response content, and store the current attack instruction and response result in the historical attack database.