Honeypot countering method, device and equipment based on MySQL service and storage medium
By generating simulated database instances in the database honeypot system, analyzing the attacker's local storage files and establishing an attacker's portrait, and generating blocking instructions, the problem of low counter-efficiency of honeypots is solved, efficient attack identification and blocking is achieved, and cost is reduced.
Patent Information
- Application Number
- CN202510645885.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-05-20
- Publication Date
- 2025-08-08
AI Technical Summary
The existing database honeypot system is less efficient in the countermeasure process, especially the deployment and maintenance costs of high interactive honeypots, which is difficult to effectively improve the efficiency of honeypot countermeasures.
Generate simulated database instances based on the real business environment, simulate database login interaction process, use preset file loading technology to obtain local storage files of the attacker, parse identity data fields and attack tool configuration parameters, establish an attacker's portrait, and generate blocking instructions based on the portrait to block attack operations.
It improves the efficiency of honeypot countermeasures, improves the user experience, can effectively identify and block attackers, reduces the risk of attackers' identification, and avoids the high cost of high interactive honeypots.
Smart Images
Figure CN120455102A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of network security technology, and in particular to a honeypot countermeasure method, device, equipment and storage medium based on MySQL service. Background Art
[0002] With the rapid development of the internet and computer networks, network security has become a global concern. Security threats such as hacker attacks, malware, and data leaks are increasing, posing severe challenges to individuals, businesses, and even national security. To protect network resources and sensitive data, security measures such as firewalls, intrusion detection systems (IDS), and intrusion prevention systems (IPS) have become widely used. However, while these traditional protection technologies have played a positive role in preventing known attacks and threats, as attackers' methods continue to evolve, traditional protection systems often struggle to cope with new attack methods.
[0003] Database honeypot technology, as a proactive network security defense mechanism, has been widely used in the cybersecurity field in recent years. Honeypots create disguised systems or services to lure attackers into performing illegal activities, thereby collecting attack data and analyzing their behavior. Existing database honeypot systems can generally be divided into two categories: low-interaction honeypots and high-interaction honeypots. Low-interaction honeypots interact with attackers by simulating simple network services, effectively capturing simple attack behaviors. However, the depth of information collected is relatively limited. High-interaction honeypots, on the other hand, provide a more complex and realistic environment, allowing attackers to conduct in-depth operations, thereby obtaining more detailed attack behavior data. However, their deployment and maintenance costs are higher.
[0004] As can be seen from the above, how to improve the efficiency of honeypot countermeasures in the honeypot countermeasure process based on MySQL services is an urgent problem to be solved. Summary of the Invention
[0005] In view of this, the purpose of the present invention is to provide a honeypot countermeasure method, apparatus, device, and storage medium based on MySQL service, which can improve the efficiency of honeypot countermeasure during the honeypot countermeasure process based on MySQL service. The specific scheme is as follows:
[0006] In the first aspect, the present application provides a honeypot countermeasure method based on MySQL service, including:
[0007] Generate a simulated database instance based on a real business environment so that when the simulated database instance detects an attacker executing an attack instruction, it can determine the corresponding configuration parameters and response data of the database; the simulated database instance is used to receive connection requests and simulate the database login interaction process;
[0008] Obtaining a local storage file corresponding to the attacker from the attacker's terminal device using a preset file loading technology based on the configuration parameters and the response data;
[0009] Parsing the identity data field and attack tool configuration parameters in the local storage file to obtain an identity identification field and remote control instruction characteristics corresponding to the attacker, and then establishing an attacker profile including attacker identity attributes, attack tool chain information, and attack behavior characteristics based on the identity identification field and the remote control instruction characteristics;
[0010] A corresponding countermeasure strategy library is determined based on the attacker portrait, and a blocking instruction including the attacker's corresponding network address and attack tool is generated using the countermeasure strategy library, so as to block the attacker's attack operation using the blocking instruction.
[0011] Optionally, when the simulated database instance detects that an attacker executes an attack instruction, determining configuration parameters and response data corresponding to the database includes:
[0012] When the simulation database instance detects that an attacker executes an attack instruction, determining an instruction structure feature corresponding to the attack instruction based on the attack instruction, and determining a corresponding attack grammar based on the instruction structure feature and a preset attack pattern feature library;
[0013] The configuration parameters corresponding to the database are determined based on the version information fingerprint corresponding to the database and the instruction structure characteristics, and the response data including the inductive data table structure is determined based on the attack mode corresponding to the attack instruction and the attack syntax.
[0014] Optionally, the using a preset file loading technology and obtaining a local storage file corresponding to the attacker from the attacker's terminal device based on the configuration parameters and the response data includes:
[0015] Constructing an abnormal query response instruction including a file loading instruction so that the attacker executes a file transfer protocol based on the abnormal query response instruction;
[0016] When it is detected that the attacker executes a file transfer protocol based on the abnormal query response instruction, a preset file loading technology is used to determine a file path including browser authentication information stored in the attacker's terminal device based on the configuration parameters and the response data;
[0017] A file to be decrypted containing encrypted credentials is obtained based on the file path, and a decryption operation is performed on the file to be decrypted to obtain a local storage file corresponding to the terminal device; the local storage file includes identity authentication data corresponding to the attacker, login credentials for the browser website, and user registration information corresponding to the browser website.
[0018] Optionally, parsing the identity data field and attack tool configuration parameters in the local storage file to obtain the identity identification field and remote control instruction characteristics corresponding to the attacker includes:
[0019] Performing form data extraction operations on each of the locally stored files to obtain identity data fields corresponding to each of the locally stored files, including mobile phone numbers and email addresses;
[0020] Determining a command control server address and a communication encryption key corresponding to each locally stored file based on a file format corresponding to each locally stored file and the identity data field;
[0021] An association operation is performed on the same identity data in the identity data fields of each of the locally stored files to obtain an association result, and a remote control instruction feature including a mapping relationship between the attacker's identity data and the attack tool is determined based on the association result, the command control server address, and the communication encryption key.
[0022] Optionally, establishing an attacker profile including attacker identity attributes, attack tool chain information, and attack behavior characteristics based on the identity identification field and the remote control instruction characteristics includes:
[0023] Matching the identity identification field with each identity data in a preset identity database to obtain identity attributes including occupation attributes and organization information corresponding to the attacker;
[0024] Determine attack tool chain information including attack type and version information corresponding to the attacker's attack tool based on the communication protocol feature in the remote control instruction feature;
[0025] Determine the attack behavior characteristic parameters of the attacker within a preset time period, and generate attack behavior characteristics including attack frequency, penetration path and vulnerability exploitation method based on the attack behavior characteristic parameters.
[0026] Optionally, determining a corresponding countermeasure strategy library based on the attacker profile, and using the countermeasure strategy library to generate a blocking instruction including a network address corresponding to the attacker and an attack tool, includes:
[0027] Determining a network address and a countermeasure policy library corresponding to the attacker's terminal device based on the attacker profile, determining a geographic location feature based on the network address, and then determining a routing filtering policy based on the geographic location feature and the countermeasure policy library;
[0028] Parse the command control server address in the remote control instruction feature, and send a domain name resolution pollution instruction to the target network security device based on the command control server address, so that the target network security device generates a false response data packet with protocol compatibility based on the attack type and version information of the attack tool, and then determines a blocking instruction based on the routing filtering policy and the false response data packet.
[0029] Optionally, after using the blocking instruction to block the attacker's attack operation, the method further includes:
[0030] Monitor the database table structure of the real business system to obtain monitoring results, and use the monitoring results to update metadata information corresponding to the simulated database instance to obtain a new simulated database instance;
[0031] A response delay characteristic is determined for a business query time in a MySQL service to obtain a response delay characteristic, and a protocol interaction time parameter of the database is adjusted using the response delay characteristic, so as to adjust parameters of the database using the obtained new protocol interaction time parameter.
[0032] In a second aspect, the present application provides a honeypot countermeasure device based on MySQL service, including:
[0033] A database instance generation module is used to generate a simulated database instance based on a real business environment so that when the simulated database instance detects an attacker executing an attack instruction, it can determine the corresponding configuration parameters and response data of the database; the simulated database instance is used to receive connection requests and simulate the database login interaction process;
[0034] a storage file acquisition module, configured to acquire a local storage file corresponding to the attacker from the attacker's terminal device using a preset file loading technology and based on the configuration parameters and the response data;
[0035] an attacker profile determination module, configured to parse the identity data field and attack tool configuration parameters in the locally stored file to obtain an identity identification field and remote control instruction characteristics corresponding to the attacker, and then establish an attacker profile including attacker identity attributes, attack tool chain information, and attack behavior characteristics based on the identity identification field and the remote control instruction characteristics;
[0036] A blocking instruction determination module is used to determine a corresponding countermeasure strategy library based on the attacker portrait, and use the countermeasure strategy library to generate a blocking instruction including the attacker's corresponding network address and attack tool, so as to use the blocking instruction to block the attacker's attack operation.
[0037] In a third aspect, the present application provides an electronic device, comprising:
[0038] Memory, used to store computer programs;
[0039] A processor is used to execute the computer program to implement the aforementioned honeypot countermeasure method based on MySQL service.
[0040] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the aforementioned honeypot countermeasure method based on MySQL service.
[0041] As can be seen from the above, before performing honeypot countermeasures based on MySQL services, this application needs to generate a simulated database instance based on a real business environment, so that when the simulated database instance detects that the attacker executes an attack instruction, the corresponding configuration parameters and response data of the database are determined; the simulated database instance is used to receive connection requests and simulate the database login interaction process; the preset file loading technology is used to obtain the local storage file corresponding to the attacker from the attacker's terminal device based on the configuration parameters and response data; the identity data field and the attack tool configuration parameters in the local storage file are parsed to obtain the identity identification field and remote control instruction characteristics corresponding to the attacker, and then an attacker portrait including the attacker's identity attributes, attack tool chain information and attack behavior characteristics is established based on the identity identification field and remote control instruction characteristics; the corresponding countermeasure strategy library is determined based on the attacker portrait, and the countermeasure strategy library is used to generate a blocking instruction including the attacker's corresponding network address and attack tool, so as to use the blocking instruction to block the attacker's attack operation.
[0042] It can be seen that this application first needs to generate a simulated database instance based on a real business environment, so that when the simulated database instance detects that the attacker executes the attack instruction, the corresponding configuration parameters and response data of the database are determined; the simulated database instance is used to receive connection requests and simulate the database login interaction process; then, the preset file loading technology is used to obtain the local storage file corresponding to the attacker from the attacker's terminal device based on the configuration parameters and response data; the identity data field and the attack tool configuration parameters in the local storage file are parsed to obtain the identity identification field and remote control instruction characteristics corresponding to the attacker, and then based on the identity identification field and the remote control instruction characteristics, an attacker portrait containing the attacker's identity attributes, attack tool chain information and attack behavior characteristics is established; finally, the corresponding countermeasure strategy library is determined based on the attacker portrait, and the countermeasure strategy library is used to generate a blocking instruction including the attacker's corresponding network address and attack tool, so as to use the blocking instruction to block the attacker's attack operation. In this way, the efficiency of the honeypot countermeasure is improved, thereby improving the user experience. BRIEF DESCRIPTION OF THE DRAWINGS
[0043] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.
[0044] Figure 1 This is a flow chart of a honeypot countermeasure method based on MySQL service disclosed in this application;
[0045] Figure 2 This is a flowchart of a specific honeypot countermeasure method based on MySQL service disclosed in this application;
[0046] Figure 3 This is a schematic diagram of the structure of a honeypot countermeasure device based on MySQL service disclosed in this application;
[0047] Figure 4 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION
[0048] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.
[0049] As an active network security defense mechanism, database honeypot technology has been widely used in the field of network security in recent years. Honeypots create disguised systems or services to lure attackers into performing illegal activities, thereby collecting attack data and analyzing the attacker's behavior. Existing database honeypot systems can generally be divided into two categories: low-interaction honeypots and high-interaction honeypots. Low-interaction honeypots can effectively capture simple attack behaviors by simulating simple network services to interact with attackers, but the depth of their information collection is relatively limited; high-interaction honeypots provide a more complex and realistic environment, allowing attackers to perform in-depth operations, so they can obtain more detailed attack behavior data, but their deployment and maintenance costs are relatively high. To this end, the present application provides a honeypot countermeasure method based on MySQL services, which can improve the efficiency of honeypot countermeasures in the honeypot countermeasure process based on MySQL services.
[0050] See also Figure 1 As shown, the embodiment of the present invention discloses a honeypot countermeasure method based on MySQL service, including:
[0051] Step S11: Generate a simulated database instance based on a real business environment so that when the simulated database instance detects that an attacker executes an attack instruction, it determines the configuration parameters and response data corresponding to the database; the simulated database instance is used to receive connection requests and simulate the database login interaction process.
[0052] In this embodiment, when conducting honeypot countermeasures based on MySQL (My Structured Query Language, a relational database management system) services, this embodiment of the application generates a simulated database instance based on a real business environment, using the simulated database instance to lure attackers into performing database connection operations. It is worth mentioning that, unlike traditional honeypots, this embodiment of the application does not directly guide attackers into a static, easily identifiable honeypot environment. Instead, it uses the real business environment as an inducement node and configures the database configuration and response based on the attacker's behavior, making the entire honeypot environment more covert and realistic.
[0053] In this embodiment, when an attacker uses common hacking tools or means to attempt to connect to the database, the embodiment of the present application generates a realistic MySQL instance to simulate the real login process and data interaction, thereby reducing the risk of being identified. Specifically, when the simulated database instance detects that the attacker executes an attack instruction, the corresponding configuration parameters and response data of the database are determined, which may include: when the simulated database instance detects that the attacker executes an attack instruction, determining the instruction structure characteristics corresponding to the attack instruction based on the attack instruction, and determining the corresponding attack grammar based on the instruction structure characteristics and a preset attack pattern feature library; determining the configuration parameters corresponding to the database based on the version information fingerprint corresponding to the database and the instruction structure characteristics, and determining the response data containing the inductive data table structure based on the attack pattern and attack grammar corresponding to the attack instruction.
[0054] Step S12: using a preset file loading technology and based on the configuration parameters and the response data, obtaining a local storage file corresponding to the attacker from the attacker's terminal device.
[0055] In this embodiment, when an attacker attempts to perform certain malicious operations (such as SQL injection and data import), the embodiment of the present application needs to use MySQL's LOAD DATA LOCALINFILE (a MySQL command used to quickly import data from a client's local file into a database table) technology to read files from the attacker's local environment, such as the browser's login password file and sensitive information stored by the browser, based on the database's corresponding configuration parameters and response data. This information typically includes the attacker's identity information (such as mobile phone number, email address, ID number, company affiliation, etc.) and the attacker's configuration information for remotely controlling the hacking software (such as the malware's control address and the attack tool's configuration file).
[0056] Specifically, using a preset file loading technology and based on configuration parameters and response data to obtain a local storage file corresponding to the attacker from the attacker's terminal device can include: constructing an abnormal query response instruction containing a file loading instruction so that the attacker executes a file transfer protocol based on the abnormal query response instruction; when it is detected that the attacker executes the file transfer protocol based on the abnormal query response instruction, using a preset file loading technology and based on configuration parameters and response data to determine a file path including browser authentication information stored in the attacker's terminal device; based on the file path, obtaining a file to be decrypted including encrypted credentials, and performing a decryption operation on the file to be decrypted to obtain a local storage file corresponding to the terminal device; the local storage file includes identity authentication data corresponding to the attacker, login credentials of the browser website, and user registration information corresponding to the browser website.
[0057] In one specific embodiment, LOAD DATA LOCAL INFILE technology is used to read files on the attacker's PC (Personal Computer). That is, when the attacker performs specific operations, the embodiment of the present application can use MySQL's LOAD DATA LOCAL INFILE technology to extract locally stored browser files from the attacker's PC, such as Chrome (Google Chrome) login password files, browser cookies (HTTP Cookies, browser cookies), etc. These files typically contain the attacker's login credentials for different websites, personal information, and configuration files for the attacker's remote control software. It is worth mentioning that the information extracted from the configuration files in this embodiment of the application includes, but is not limited to, the attacker's mobile phone number, email address, ID number, company affiliation, and related attack tool configurations. By deeply analyzing this data, this embodiment of the application can reveal the attacker's identity background, attack habits, and the tool chain used, providing clues for subsequent tracing and countermeasures.
[0058] Step S13: Parse the identity data field and attack tool configuration parameters in the local storage file to obtain the identity identification field and remote control instruction characteristics corresponding to the attacker, and then establish an attacker portrait including the attacker's identity attributes, attack tool chain information, and attack behavior characteristics based on the identity identification field and the remote control instruction characteristics.
[0059] In this embodiment, the present application monitors the attacker's operational behavior in the honeypot in real time, combining artificial intelligence algorithms with deep learning models to identify the attacker's behavioral patterns. By extracting identity information from the attacker's local files (such as browser password files), the present application embodiment can effectively trace the attacker's true identity and track their network footprint, including key information such as the source IP (Internet Protocol) address, the attack tool used, and the tool configuration file. Specifically, parsing the identity data fields and attack tool configuration parameters in the local storage files to obtain the attacker's corresponding identity identification field and remote control command characteristics can include: performing a form data extraction operation on each local storage file to obtain the identity data field corresponding to each local storage file, including a mobile phone number and email address; determining the command and control server address and communication encryption key corresponding to each local storage file based on the file format and identity data field corresponding to each local storage file; correlating the identical identity data in the identity data fields of each local storage file to obtain a correlation result; and determining the remote control command characteristics, including the mapping relationship between the attacker's identity data and the attack tool, based on the correlation result, the command and control server address, and the communication encryption key.
[0060] Furthermore, after obtaining the attacker's personal information and attack tool configuration information, embodiments of the present application construct a hacker profile based on this information. Specifically, embodiments of the present application combine the attacker's personal information (such as mobile phone number, email address, and ID number) with the attack tool configuration information to construct a hacker profile corresponding to the attacker. This hacker profile includes, but is not limited to, the attacker's identity information, tool configuration, and attack patterns. In one specific embodiment, identity information includes the attacker's mobile phone number, email address, and affiliation to help track the attacker's true identity. Tool configuration includes the attacker's remote control software configuration information and its corresponding attack tool chain to determine the attacker's attack methods, attack objectives, and historical attack behaviors. Attack patterns are identified through in-depth analysis of the attacker's attack behaviors, including specific vulnerabilities, attack methods, and attack frequency and patterns. Attack methods include, but are not limited to, SQL injection, brute force attacks, and XSS (cross-site scripting).
[0061] Specifically, establishing an attacker portrait including the attacker's identity attributes, attack tool chain information, and attack behavior characteristics based on the identity identification field and the remote control instruction characteristics may include: matching the identity identification field with each identity data in the preset identity database to obtain identity attributes including occupational attributes and institutional information corresponding to the attacker; determining the attack tool chain information including the attack type and version information corresponding to the attacker's attack tool based on the communication protocol characteristics in the remote control instruction characteristics; determining the attacker's attack behavior characteristic parameters within a preset time period, and generating attack behavior characteristics including attack frequency, penetration path, and vulnerability exploitation method based on the attack behavior characteristic parameters.
[0062] Step S14: determining a corresponding countermeasure strategy library based on the attacker portrait, and using the countermeasure strategy library to generate a blocking instruction including the attacker's corresponding network address and attack tool, so as to use the blocking instruction to block the attacker's attack operation.
[0063] In this embodiment, after obtaining the attacker portrait corresponding to the attacker, the embodiment of the present application can determine the corresponding blocking instructions based on the attacker's hacker portrait, so as to use the blocking instructions to block the attacker's attack operations. In a specific embodiment, the embodiment of the present application can implement network blocking or DNS (Domain Name System) pollution operations for the attacker's source IP to block further attacks, or trigger advanced firewall policies to limit access to specific data tables. Furthermore, if the blocking instructions fail to block the attacker's attack behavior, the embodiment of the present application can provide the attacker's personal information and attack tool configuration to the security department so that the security department can help track the attacker's true identity and hold him accountable.
[0064] Specifically, determining the corresponding countermeasure strategy library based on the attacker portrait, and using the countermeasure strategy library to generate blocking instructions including the attacker's corresponding network address and attack tool, can include: determining the network address and countermeasure strategy library corresponding to the attacker's terminal device based on the attacker portrait, and determining the geographic location characteristics based on the network address, and then determining the routing filtering strategy based on the geographic location characteristics and the countermeasure strategy library; parsing the command control server address in the remote control instruction characteristics, and sending the domain name resolution pollution instruction to the target network security device based on the command control server address, so that the target network security device generates a false response data packet with protocol compatibility based on the attack type and version information of the attack tool, and then determines the blocking instruction based on the routing filtering strategy and the false response data packet.
[0065] It is worth mentioning that the honeypot countermeasure method adopted in the embodiment of the present application can make it difficult for attackers to realize that they are interacting with the honeypot system. In addition, dynamic configuration and adaptive response mechanisms can be used, and real-time adjustments can be made based on the attacker's behavior. In addition, the embodiment of the present application avoids the use of obvious honeypot identifiers (such as common virtual table names such as "TESTDB"), and simulates an environment that is almost consistent with the real production system by dynamically adjusting the database status. When the attacker performs various attack behaviors, the embodiment of the present application will intelligently simulate responses consistent with the real database to prevent the attacker from identifying it as a virtual environment. In this way, when interacting with the honeypot system, it is difficult for the attacker to realize that he is entering a monitoring environment, and the flow chart of honeypot countermeasure based on MySQL service is as follows Figure 2 shown.
[0066] Specifically, after using the blocking instruction to block the attacker's attack operation, it can also include: monitoring the database table structure of the real business system to obtain the monitoring results, and using the monitoring results to update the metadata information corresponding to the simulated database instance to obtain a new simulated database instance; determining the response delay characteristics of the business query time in the MySQL service to obtain the response delay characteristics, and using the response delay characteristics to adjust the protocol interaction time parameters of the database, and using the obtained new protocol interaction time parameters to adjust the parameters of the database.
[0067] As can be seen from the above, the embodiment of the present application first needs to generate a simulated database instance based on a real business environment, so that when the simulated database instance detects that the attacker executes the attack instruction, the configuration parameters and response data corresponding to the database are determined; the simulated database instance is used to receive a connection request and simulate the database login interaction process; then, the preset file loading technology is used to obtain the local storage file corresponding to the attacker from the attacker's terminal device based on the configuration parameters and response data; the identity data field and the attack tool configuration parameters in the local storage file are parsed to obtain the identity identification field and remote control instruction characteristics corresponding to the attacker, and then based on the identity identification field and the remote control instruction characteristics, an attacker portrait containing the attacker's identity attributes, attack tool chain information and attack behavior characteristics is established; finally, the corresponding countermeasure strategy library is determined based on the attacker portrait, and the countermeasure strategy library is used to generate a blocking instruction including the attacker's corresponding network address and attack tool, so as to use the blocking instruction to block the attacker's attack operation. In this way, the efficiency of honeypot countermeasures is improved, thereby improving the user experience.
[0068] Accordingly, see Figure 3 As shown, the present application also provides a honeypot countermeasure device based on MySQL service, including:
[0069] The database instance generation module 11 is used to generate a simulated database instance based on a real business environment so that when the simulated database instance detects that an attacker has executed an attack instruction, the corresponding configuration parameters and response data of the database are determined; the simulated database instance is used to receive connection requests and simulate the database login interaction process;
[0070] a storage file acquisition module 12, configured to acquire a local storage file corresponding to the attacker from the attacker's terminal device using a preset file loading technology and based on the configuration parameters and the response data;
[0071] An attacker profile determination module 13 is configured to parse the identity data field and the attack tool configuration parameters in the local storage file to obtain an identity identification field and remote control instruction characteristics corresponding to the attacker, and then establish an attacker profile including the attacker's identity attributes, attack tool chain information, and attack behavior characteristics based on the identity identification field and the remote control instruction characteristics;
[0072] The blocking instruction determination module 14 is used to determine the corresponding countermeasure strategy library based on the attacker portrait, and use the countermeasure strategy library to generate a blocking instruction including the attacker's corresponding network address and attack tool, so as to use the blocking instruction to block the attacker's attack operation.
[0073] As can be seen from the above, before the embodiment of the present application performs honeypot countermeasures based on MySQL service, it is first necessary to generate a simulated database instance based on a real business environment, so that when the simulated database instance detects that the attacker executes an attack instruction, the configuration parameters and response data corresponding to the database are determined; the simulated database instance is used to receive connection requests and simulate the database login interaction process; then, the preset file loading technology is used to obtain the local storage file corresponding to the attacker from the attacker's terminal device based on the configuration parameters and response data; the identity data field and the attack tool configuration parameters in the local storage file are parsed to obtain the identity identification field and remote control instruction characteristics corresponding to the attacker, and then an attacker portrait containing the attacker's identity attributes, attack tool chain information and attack behavior characteristics is established based on the identity identification field and the remote control instruction characteristics; finally, the corresponding countermeasure strategy library is determined based on the attacker portrait, and the countermeasure strategy library is used to generate a blocking instruction including the attacker's corresponding network address and attack tool, so as to use the blocking instruction to block the attacker's attack operation. In this way, the efficiency of honeypot countermeasures is improved, thereby improving the user experience.
[0074] In some specific implementations, the database instance generation module 11 may specifically include:
[0075] an attack grammar determination unit, configured to, when the simulation database instance detects that an attacker executes an attack instruction, determine an instruction structure feature corresponding to the attack instruction based on the attack instruction, and determine a corresponding attack grammar based on the instruction structure feature and a preset attack pattern feature library;
[0076] A response data determination unit is used to determine the configuration parameters corresponding to the database based on the version information fingerprint corresponding to the database and the instruction structure characteristics, and to determine the response data including the inductive data table structure based on the attack mode corresponding to the attack instruction and the attack syntax.
[0077] In some specific implementations, the storage file acquisition module 12 may specifically include:
[0078] a query response instruction determining unit, configured to construct an abnormal query response instruction including a file loading instruction, so that the attacker executes a file transfer protocol based on the abnormal query response instruction;
[0079] A file path determining unit, configured to, when detecting that the attacker executes a file transfer protocol based on the abnormal query response instruction, determine a file path including browser authentication information stored in the attacker's terminal device using a preset file loading technology and based on the configuration parameters and the response data;
[0080] A storage file acquisition subunit is used to obtain a file to be decrypted containing encrypted credentials based on the file path, and decrypt the file to be decrypted to obtain a local storage file corresponding to the terminal device; the local storage file includes identity authentication data corresponding to the attacker, login credentials of the browser website, and user registration information corresponding to the browser website.
[0081] In some specific implementations, the attacker profile determination module 13 may specifically include:
[0082] An identity data field determination unit is used to perform form data extraction operations on each of the local storage files to obtain identity data fields corresponding to each of the local storage files, including mobile phone numbers and email addresses;
[0083] A server address determining unit, configured to determine a command control server address and a communication encryption key corresponding to each locally stored file based on a file format corresponding to each locally stored file and the identity data field;
[0084] An instruction feature determination unit is used to associate the same identity data in the identity data fields of each of the locally stored files to obtain an association result, and determine the remote control instruction feature including the mapping relationship between the attacker's identity data and the attack tool based on the association result, the command control server address and the communication encryption key.
[0085] In some specific implementations, the attacker profile determination module 13 may specifically include:
[0086] an identity attribute determination unit, configured to match the identity identification field with each identity data in a preset identity database to obtain identity attributes including occupational attributes and organization information corresponding to the attacker;
[0087] a tool chain information determining unit, configured to determine attack tool chain information including an attack type and version information corresponding to the attacker's attack tool based on a communication protocol feature in the remote control instruction feature;
[0088] The behavior feature determination unit is used to determine the attack behavior feature parameters of the attacker within a preset time period, and generate attack behavior features including attack frequency, penetration path and vulnerability exploitation method based on the attack behavior feature parameters.
[0089] In some specific implementations, the blocking instruction determination module 14 may specifically include:
[0090] a routing filtering policy determining unit, configured to determine a network address corresponding to the attacker's terminal device and a countermeasure policy library based on the attacker profile, determine a geographic location feature based on the network address, and then determine a routing filtering policy based on the geographic location feature and the countermeasure policy library;
[0091] A blocking instruction determination subunit is used to parse the command control server address in the remote control instruction feature, and send a domain name resolution pollution instruction to the target network security device based on the command control server address, so that the target network security device generates a false response data packet with protocol compatibility based on the attack type and version information of the attack tool, and then determines the blocking instruction based on the routing filtering policy and the false response data packet.
[0092] In some specific implementations, the honeypot countermeasure device based on the MySQL service may further include:
[0093] A monitoring result determination unit is used to monitor the database table structure of the real business system to obtain monitoring results, and to use the monitoring results to update the metadata information corresponding to the simulated database instance to obtain a new simulated database instance;
[0094] A parameter adjustment unit is used to determine the response delay characteristics of the business query time in the MySQL service, obtain the response delay characteristics, and use the response delay characteristics to adjust the protocol interaction time parameters of the database, so as to use the obtained new protocol interaction time parameters to adjust the parameters of the database.
[0095] Furthermore, the embodiment of the present application also discloses an electronic device, Figure 4 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram cannot be considered as any limitation on the scope of use of this application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the honeypot countermeasure method based on the MySQL service disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.
[0096] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device. The communication protocol it follows is any communication protocol that can be applied to the technical solution of this application and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world. Its specific interface type can be selected according to specific application needs and is not specifically limited here.
[0097] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or CD, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.
[0098] The operating system 221 is used to manage and control the hardware devices and computer program 222 on the electronic device 20, and can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to implement the honeypot countermeasure method based on the MySQL service executed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.
[0099] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when executed by a processor, the computer program implements the aforementioned MySQL service-based honeypot countermeasure method. The specific steps of this method can be referred to the corresponding content disclosed in the aforementioned embodiments and will not be repeated here.
[0100] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from the other embodiments. Reference can be made to the descriptions of the identical or similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and the relevant parts can be referred to the descriptions of the methods.
[0101] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.
[0102] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.
[0103] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.
[0104] The above is a detailed introduction to the technical solution provided by the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for those skilled in the art, according to the ideas of the present application, there may be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.
Claims
1. A honeypot countermeasure method based on MySQL service, characterized in that: include: Generate a simulated database instance based on a real business environment so that when the simulated database instance detects an attacker executing an attack instruction, it can determine the corresponding configuration parameters and response data of the database; the simulated database instance is used to receive connection requests and simulate the database login interaction process; Obtaining a local storage file corresponding to the attacker from the attacker's terminal device using a preset file loading technology based on the configuration parameters and the response data; Parsing the identity data field and attack tool configuration parameters in the local storage file to obtain an identity identification field and remote control instruction characteristics corresponding to the attacker, and then establishing an attacker profile including attacker identity attributes, attack tool chain information, and attack behavior characteristics based on the identity identification field and the remote control instruction characteristics; A corresponding countermeasure strategy library is determined based on the attacker portrait, and a blocking instruction including the attacker's corresponding network address and attack tool is generated using the countermeasure strategy library, so as to block the attacker's attack operation using the blocking instruction.
2. The honeypot countermeasure method based on MySQL service according to claim 1, characterized in that: When the simulated database instance detects that an attacker executes an attack instruction, determining configuration parameters and response data corresponding to the database includes: When the simulation database instance detects that an attacker executes an attack instruction, determining an instruction structure feature corresponding to the attack instruction based on the attack instruction, and determining a corresponding attack grammar based on the instruction structure feature and a preset attack pattern feature library; The configuration parameters corresponding to the database are determined based on the version information fingerprint corresponding to the database and the instruction structure characteristics, and the response data including the inductive data table structure is determined based on the attack mode corresponding to the attack instruction and the attack syntax.
3. The honeypot countermeasure method based on MySQL service according to claim 1, characterized in that: The method of obtaining a local storage file corresponding to the attacker from the attacker's terminal device by using a preset file loading technology and based on the configuration parameters and the response data includes: Constructing an abnormal query response instruction including a file loading instruction so that the attacker executes a file transfer protocol based on the abnormal query response instruction; When it is detected that the attacker executes a file transfer protocol based on the abnormal query response instruction, a preset file loading technology is used to determine a file path including browser authentication information stored in the attacker's terminal device based on the configuration parameters and the response data; A file to be decrypted containing encrypted credentials is obtained based on the file path, and a decryption operation is performed on the file to be decrypted to obtain a local storage file corresponding to the terminal device; the local storage file includes identity authentication data corresponding to the attacker, login credentials for the browser website, and user registration information corresponding to the browser website.
4. The honeypot countermeasure method based on MySQL service according to claim 1, characterized in that: The parsing of the identity data field and the attack tool configuration parameters in the local storage file to obtain the identity identification field and remote control instruction characteristics corresponding to the attacker includes: Performing form data extraction operations on each of the locally stored files to obtain identity data fields corresponding to each of the locally stored files, including mobile phone numbers and email addresses; Determining a command control server address and a communication encryption key corresponding to each locally stored file based on a file format corresponding to each locally stored file and the identity data field; An association operation is performed on the same identity data in the identity data fields of each of the locally stored files to obtain an association result, and a remote control instruction feature including a mapping relationship between the attacker's identity data and the attack tool is determined based on the association result, the command control server address, and the communication encryption key.
5. The honeypot countermeasure method based on MySQL service according to claim 4 is characterized in that: The step of establishing an attacker profile including attacker identity attributes, attack tool chain information, and attack behavior characteristics based on the identity identification field and the remote control instruction characteristics includes: Matching the identity identification field with each identity data in a preset identity database to obtain identity attributes including occupation attributes and organization information corresponding to the attacker; Determining attack tool chain information including attack type and version information corresponding to the attacker's attack tool based on the communication protocol feature in the remote control instruction feature; Determine the attack behavior characteristic parameters of the attacker within a preset time period, and generate attack behavior characteristics including attack frequency, penetration path and vulnerability exploitation method based on the attack behavior characteristic parameters.
6. The honeypot countermeasure method based on MySQL service according to claim 5, characterized in that: Determining a corresponding countermeasure strategy library based on the attacker profile, and using the countermeasure strategy library to generate a blocking instruction including the attacker's corresponding network address and attack tool, includes: Determining a network address and a countermeasure policy library corresponding to the attacker's terminal device based on the attacker profile, determining a geographic location feature based on the network address, and then determining a routing filtering policy based on the geographic location feature and the countermeasure policy library; Parse the command control server address in the remote control instruction feature, and send a domain name resolution pollution instruction to the target network security device based on the command control server address, so that the target network security device generates a false response data packet with protocol compatibility based on the attack type and version information of the attack tool, and then determines a blocking instruction based on the routing filtering policy and the false response data packet.
7. The honeypot countermeasure method based on MySQL service according to claim 1, characterized in that: After the blocking instruction is used to block the attacker's attack operation, the method further includes: Monitor the database table structure of the real business system to obtain monitoring results, and use the monitoring results to update metadata information corresponding to the simulated database instance to obtain a new simulated database instance; A response delay characteristic is determined for a business query time in a MySQL service to obtain a response delay characteristic, and a protocol interaction time parameter of the database is adjusted using the response delay characteristic, so as to adjust parameters of the database using the obtained new protocol interaction time parameter.
8. A honeypot countermeasure device based on MySQL service, characterized in that: include: A database instance generation module is used to generate a simulated database instance based on a real business environment so that when the simulated database instance detects an attacker executing an attack instruction, it can determine the corresponding configuration parameters and response data of the database; the simulated database instance is used to receive connection requests and simulate the database login interaction process; a storage file acquisition module, configured to acquire a local storage file corresponding to the attacker from the attacker's terminal device using a preset file loading technology and based on the configuration parameters and the response data; an attacker profile determination module, configured to parse the identity data field and attack tool configuration parameters in the locally stored file to obtain an identity identification field and remote control instruction characteristics corresponding to the attacker, and then establish an attacker profile including attacker identity attributes, attack tool chain information, and attack behavior characteristics based on the identity identification field and the remote control instruction characteristics; A blocking instruction determination module is used to determine a corresponding countermeasure strategy library based on the attacker portrait, and use the countermeasure strategy library to generate a blocking instruction including the attacker's corresponding network address and attack tool, so as to use the blocking instruction to block the attacker's attack operation.
9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the honeypot countermeasure method based on MySQL service according to any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that Used to store a computer program, wherein when the computer program is executed by a processor, the honeypot countermeasure method based on MySQL service according to any one of claims 1 to 7 is implemented.