Spring boot-based honeypot countering method, apparatus and device, and storage medium

Abstract

The invention discloses a Spring boot-based honeypot countering method, device and equipment and a storage medium, and relates to the technical field of network security, and the method comprises the steps: when a preset reverse proxy server receives an access request issued by an attacker, matching the access request with an attack routing rule, if the matching succeeds, issuing the access request to a honeypot, and if the matching succeeds, sending the access request to the honeypot; the honeypot sends a simulation information page determined based on the access request to an equipment interface of the attacker; when an attacker accesses the simulation information page, determining a honeypot guidance strategy based on an attack behavior of the attacker, and introducing the attacker into a honeypot network comprising a plurality of simulation service nodes by using the honeypot guidance strategy; and after an attacker accesses the simulation service node, recording an attacker portrait including a real network address of the attacker and access behavior data, and performing behavior countering based on the attacker portrait by using a countering strategy in the simulation service node. Therefore, the honeypot preparation efficiency can be improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a Spring Boot-based honeypot countermeasure method, device, equipment, and storage medium. Background Art

[0002] Currently, in today's complex international cybersecurity environment, honeypot technology serves as an extremely important proactive defense measure. However, existing honeypot technologies are mostly based on simulated vulnerability environment services. Due to the lack of relevance to real business, these honeypot technologies are easily identified as honeypot systems by attackers. Most existing honeypot technologies are based on simulated vulnerability environment services as their core technology, using hardware nodes to build virtual simulated honeypot systems. This type of honeypot technology has the following shortcomings:

[0003] First, existing honeypot technology is easy to identify: existing honeypot systems often independently deploy a set of honeypot vulnerability service environments based on historical vulnerabilities to induce attackers to attack the vulnerability environment for tracing and countermeasures. However, with this type of technology, attackers can currently identify honeypots through front-end code, server interfaces, and other features, and easily identify that it is a honeypot system environment, making the honeypot system extremely easy to identify.

[0004] Second, existing honeypot technology lacks simulation capabilities: existing honeypot systems often independently deploy a honeypot vulnerability service environment based on historical vulnerabilities, which has nothing to do with real business, resulting in the honeypot system being out of touch with real business.

[0005] Third, existing honeypot technology is costly and inflexible to deploy: Existing honeypot systems require hardware or large-scale software deployment, typically operating with a single server and multiple front-end honeypot agent nodes. This technical architecture is inefficient in terms of both cost and deployment efficiency.

[0006] From the above, it can be seen that how to improve the efficiency of honeypot countermeasures in the process of honeypot countermeasures based on Spring Boot is an urgent problem to be solved. Summary of the Invention

[0007] In view of this, the purpose of the present invention is to provide a Spring Boot-based honeypot countermeasure method, device, equipment, and storage medium, which can improve the efficiency of honeypot countermeasures in the Spring Boot-based honeypot countermeasure process, thereby improving the security of the production process. The specific scheme is as follows:

[0008] In the first aspect, this application provides a honeypot countermeasure method based on Spring Boot, including:

[0009] Attack routing rules are configured in a preset reverse proxy server. When the preset reverse proxy server receives an access request from an attacker, the access request is matched with the attack routing rules. If a match is successful, the access request is sent to a honeypot, so that the honeypot sends a simulation information page determined based on the access request to the device interface corresponding to the attacker; the simulation information page is a page obtained by simulating a real business system based on Spring Boot;

[0010] When the attacker accesses the simulation information page, a honeypot guidance strategy is determined based on the attacker's attack behavior, and the attacker is introduced into a honeypot network including a plurality of simulated service nodes using the honeypot guidance strategy; the simulated service nodes are nodes that simulate real service logic and data interaction mode;

[0011] After the attacker accesses the simulated service node, an attacker portrait including the attacker's real network address and access behavior data is recorded, and then a countermeasure strategy in the simulated service node is used to perform behavioral countermeasures based on the attacker portrait.

[0012] Optionally, configuring an attack routing rule in a preset reverse proxy server, and matching an access request sent by an attacker with the attack routing rule when the preset reverse proxy server receives the access request, includes:

[0013] Embed a preset reverse proxy server in the customer's business system; the preset reverse proxy server is used to merge the simulation information page with the real business page;

[0014] Obtaining a vulnerability fingerprint interface, a background scanning path, and a routing interface of the customer business system from a preset database, and determining an attack routing rule based on the vulnerability fingerprint interface, the background scanning path, and the routing interface of the customer business system;

[0015] The attack routing rule is configured in the preset reverse proxy server; the preset reverse proxy server is used to receive the access request sent by the attacker; the preset reverse proxy server includes an Nginx reverse proxy server and a gateway routing reverse proxy server;

[0016] When the preset reverse proxy server receives an access request sent by an attacker, it determines whether the access request meets the preset request matching condition. If the access request meets the preset request matching condition, the access request is matched with the attack routing rule.

[0017] Optionally, sending the access request to a honeypot so that the honeypot sends a simulation information page determined based on the access request to a device interface corresponding to the attacker, including:

[0018] The access request is sent to the honeypot through a cloud honeypot portal, so that the honeypot determines a first simulation information page to be processed based on the framework type and version information corresponding to the access request; the cloud honeypot portal is a static page configured in the customer business system;

[0019] A token is embedded in the first simulation information page to be processed to obtain a second simulation information page to be processed, and then a sensitive data interface is implanted in the source code corresponding to the second simulation information page to be processed to obtain a device interface, so that the honeypot can send the simulation information page to the device interface corresponding to the attacker; the token is used to determine the honeypot level corresponding to the simulation information page; the sensitive data interface is used to induce the attacker to access.

[0020] Optionally, when the attacker accesses the simulation information page, determining a honeypot guidance strategy based on the attacker's attack behavior, and using the honeypot guidance strategy to introduce the attacker into a honeypot network including a plurality of simulation service nodes, includes:

[0021] When the attacker accesses the simulation information page, determining an attack behavior based on the attacker's behavior in the simulation information page, and determining a honeypot booting strategy based on the attack behavior;

[0022] Constructing a simulated business node based on the real business logic and data interaction mode corresponding to the target application industry, and storing the simulated business node in a honeypot network; the simulated business node includes an induced behavior file corresponding to the corresponding application industry; each simulated business node in the honeypot network corresponds to a different application industry;

[0023] The attacker is introduced into the honeypot network based on the honeypot guiding strategy, so that the attacker determines the simulated service node to be accessed in the honeypot network based on the corresponding application industry.

[0024] Optionally, after the attacker accesses the simulated service node, recording an attacker profile including the attacker's real network address and access behavior data includes:

[0025] After the attacker accesses the simulated service node, using a preset information collector to collect system information corresponding to the attacker's terminal system and the attacker's corresponding behavior trajectory;

[0026] When the attacker downloads the induced behavior file in the simulated service node, bundling the terminal system with the induced behavior file to obtain a bundling result;

[0027] When the attacker attempts to establish a connection with the simulated service node, the network configuration information of the attacker is recorded by using a preset forged proxy service;

[0028] When the attacker uses an attack tool to scan the simulated service node, an attack tool feature corresponding to the attack tool is obtained by utilizing a preset tool built-in vulnerability in the simulated service node;

[0029] An attacker profile is determined based on the system information, the behavior trajectory, the bundling result, the network configuration information, and the attack tool characteristics.

[0030] Optionally, utilizing the countermeasure strategy in the simulated service node and performing behavioral countermeasures based on the attacker profile includes:

[0031] Using a preset cluster containerization technology to establish a simulated network address, and establishing an intranet environment based on the simulated network address, so as to limit the attacker's full-link penetration attack and post-penetration attack on the simulated service node to the intranet environment;

[0032] Utilize the various countermeasures in the simulated business node and perform behavioral countermeasures based on the attacker portrait; the countermeasures include Chrome browser countermeasures, object storage Trojan bundling, VPN bundling Trojans, hacker tool countermeasures, and proxy tool countermeasures.

[0033] Optionally, utilizing the countermeasure strategy in the simulated service node and performing behavioral countermeasures based on the attacker profile includes:

[0034] Performing dimensional feature analysis on the attacker profile to obtain several feature analysis results; the feature analysis results include behavioral pattern features, attack technique features, and intention motivation features corresponding to the attacker;

[0035] Determining a countermeasure strategy based on the behavior pattern characteristics, the attack technology characteristics, and the intention motivation characteristics, so as to counter the attacker's attack behavior using the countermeasure strategy;

[0036] The attacker's behavior data is collected, and the countermeasure strategy is optimized based on the behavior data, so as to counter the attacker's attack behavior using the optimized countermeasure strategy.

[0037] In the second aspect, the present application provides a honeypot countermeasure device based on Spring Boot, including:

[0038] A simulation information page sending module is used to configure attack routing rules in a preset reverse proxy server, and when the preset reverse proxy server receives an access request sent by an attacker, match the access request with the attack routing rules. If a match is successful, the access request is sent to the honeypot, so that the honeypot can send a simulation information page determined based on the access request to the device interface corresponding to the attacker; the simulation information page is a page obtained by simulating a real business system based on Spring Boot;

[0039] A honeypot boot strategy determination module is used to determine a honeypot boot strategy based on the attacker's attack behavior when the attacker accesses the simulation information page, and use the honeypot boot strategy to introduce the attacker into a honeypot network including a plurality of simulated business nodes; the simulated business nodes are nodes that simulate real business logic and data interaction methods;

[0040] A behavior countermeasure module is used to record an attacker profile including the attacker's real network address and access behavior data after the attacker accesses the simulated business node, and then use the countermeasure strategy in the simulated business node to perform behavior countermeasures based on the attacker profile.

[0041] In a third aspect, the present application provides an electronic device, comprising:

[0042] Memory, used to store computer programs;

[0043] A processor is used to execute the computer program to implement the aforementioned Spring Boot-based honeypot countermeasure method.

[0044] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program, wherein the computer program implements the aforementioned Spring Boot-based honeypot countermeasure method when executed by a processor.

[0045] As can be seen from the above, before performing honeypot countermeasures based on Spring boot, this application needs to configure attack routing rules in the preset reverse proxy server, and when the preset reverse proxy server receives an access request sent by the attacker, it matches the access request with the attack routing rules. If the match is successful, the access request is sent to the honeypot, so that the honeypot can send the simulation information page determined based on the access request to the device interface corresponding to the attacker; the simulation information page is a page obtained by simulating the real business system based on Spring boot; when the attacker accesses the simulation information page, the honeypot guidance strategy is determined based on the attacker's attack behavior, and the honeypot guidance strategy is used to introduce the attacker into the honeypot network including several simulated business nodes; the simulated business node is a node that simulates real business logic and data interaction methods; after the attacker accesses the simulated business node, the attacker portrait including the attacker's real network address and access behavior data is recorded, and then the countermeasure strategy in the simulated business node is used to perform behavioral countermeasures based on the attacker portrait.

[0046] It can be seen from this that this application first needs to configure the attack routing rules in the preset reverse proxy server, and when the preset reverse proxy server receives the access request sent by the attacker, the access request is matched with the attack routing rules. If the match is successful, the access request is sent to the honeypot so that the honeypot can send the simulation information page determined based on the access request to the device interface corresponding to the attacker; the simulation information page is a page obtained by simulating the real business system based on Spring boot; then, when the attacker accesses the simulation information page, the honeypot guidance strategy is determined based on the attacker's attack behavior, and the honeypot guidance strategy is used to introduce the attacker into the honeypot network including several simulation business nodes; the simulation business node is a node that simulates the real business logic and data interaction method; finally, after the attacker accesses the simulation business node, the attacker portrait including the attacker's real network address and access behavior data is recorded, and then the countermeasure strategy in the simulation business node is used to perform behavioral countermeasures based on the attacker portrait. In this way, the efficiency of honeypot countermeasures based on Spring boot is improved, thereby improving the security of the production process. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0048] Figure 1This is a flow chart of a Spring Boot-based honeypot countermeasure method disclosed in this application;

[0049] Figure 2 A schematic diagram of a specific induction process for inducing an attacker to attack disclosed in this application;

[0050] Figure 3 This is a specific code diagram disclosed in this application for sending penetration information in a simulation information page;

[0051] Figure 4 A schematic diagram of the entire process of a specific honeypot countermeasure disclosed in this application;

[0052] Figure 5 This is a schematic diagram of the structure of a honeypot countermeasure device based on Spring Boot disclosed in this application;

[0053] Figure 6 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0054] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0055] At present, in today's complex international network security environment, honeypot technology is used as an extremely important proactive defense method. However, most of the existing honeypot technologies are based on simulated vulnerability environment services as the technical core. This type of honeypot technology is very easy to be identified as a honeypot system by attackers due to the lack of relevance to real business. Among them, most of the existing honeypot technologies are based on simulated vulnerability environment services as the technical core, and a virtual simulated honeypot system is built with hardware nodes. This type of honeypot technology has the following shortcomings: the existing honeypot technology is easy to be identified, the existing honeypot technology lacks simulation capabilities, and the existing honeypot technology is expensive and inflexible to deploy. To this end, the present application provides a honeypot countermeasure method based on Spring boot, which can improve the efficiency of honeypot countermeasures in the honeypot countermeasure process based on Spring boot, thereby improving the security of the production process.

[0056] See also Figure 1 As shown, the embodiment of the present invention discloses a honeypot countermeasure method based on Spring Boot, including:

[0057] Step S11: configure attack routing rules in the preset reverse proxy server, and when the preset reverse proxy server receives an access request sent by the attacker, match the access request with the attack routing rules. If the match is successful, the access request is sent to the honeypot so that the honeypot can send the simulation information page determined based on the access request to the device interface corresponding to the attacker; the simulation information page is a page obtained by simulating the real business system based on Spring boot.

[0058] In this embodiment, during the honeypot countermeasure process based on Spring Boot (Spring Framework Boot Module, i.e., Spring Boot framework), this application embodiment adopts three lightweight deployment methods: reverse proxy configuration, independent agent deployment, and static page configuration. This makes the honeypot guide page become a part of the customer's real business, that is, improves the simulation of the honeypot guide page. Subsequently, on the client side, reverse proxy is performed through Nginx (Engine X, i.e., Nginx server) reverse proxy or gateway routing, and then configured using preset attack routing rules. Specifically, attack routing rules are configured in a preset reverse proxy server, and when the preset reverse proxy server receives an access request sent by an attacker, the access request is matched with the attack routing rules, which may include: embedding a preset reverse proxy server in a customer business system; the preset reverse proxy server is used to merge the simulation information page with the real business page; obtaining the vulnerability fingerprint interface, the background scanning path and the routing interface of the customer business system from a preset database, and determining the attack routing rules based on the vulnerability fingerprint interface, the background scanning path and the routing interface of the customer business system; configuring the attack routing rules in the preset reverse proxy server; the preset reverse proxy server is used to receive the access request sent by the attacker; the preset reverse proxy server includes an Nginx reverse proxy server and a gateway routing reverse proxy server; when the preset reverse proxy server receives an access request sent by the attacker, it is determined whether the access request meets the preset request matching conditions, and if the access request meets the preset request matching conditions, the access request is matched with the attack routing rules.

[0059] Furthermore, when an attacker conducts a real attack or scans to trigger the reverse proxy routing rules, the embodiment of the present application will dynamically reverse the attack to the cloud honeypot entry agent, so that the cloud honeypot entry will send the simulated information page determined based on the access request to the attacker's corresponding device interface, thereby using the vulnerability information to induce the attacker to conduct a deep attack, and at the same time record the attacker's real attack IP (Internet Protocol) as a source of efficient and proactive acquisition of the attack's real IP. In a specific embodiment, the induction process of inducing the attacker to attack is as follows: Figure 2 Specifically, sending the access request to the honeypot so that the honeypot sends the simulation information page determined based on the access request to the device interface corresponding to the attacker can include: sending the access request to the honeypot through the cloud honeypot entrance so that the honeypot determines the first simulation information page to be processed based on the framework type and version information corresponding to the access request; the cloud honeypot entrance is a static page configured in the customer business system; embedding a token in the first simulation information page to be processed to obtain a second simulation information page to be processed, and then implanting a sensitive data interface in the source code corresponding to the second simulation information page to be processed to obtain a device interface, so that the honeypot sends the simulation information page to the device interface corresponding to the attacker; the token is used to determine the honeypot level corresponding to the simulation information page; the sensitive data interface is used to induce the attacker to access.

[0060] It is worth mentioning that only real attackers can trigger the routing rules built into the honeypot, thus avoiding attack interference caused by other invalid Internet scans.

[0061] Step S12: When the attacker accesses the simulation information page, a honeypot boot strategy is determined based on the attacker's attack behavior, and the attacker is introduced into a honeypot network including several simulated business nodes using the honeypot boot strategy; the simulated business nodes are nodes that simulate real business logic and data interaction methods.

[0062] In this embodiment, when an attacker accesses the simulation information page, it is almost impossible to identify the simulation information page as a honeypot system. Therefore, the simulation information page can be customized to configure the back-end multi-layer honeypot entrance through the information leakage point. Then the attacker will perform subsequent penetration actions according to the penetration information corresponding to the simulation information page in the embodiment of the present application, thereby triggering each pre-buried honeypot node in the subsequent honeypot network, so that the honeypot system can capture and counter the attacker's information. Among them, the code schematic diagram for sending the penetration information in the simulation information page is shown as follows: Figure 3Specifically, when an attacker accesses a simulation information page, a honeypot guidance strategy is determined based on the attacker's attack behavior, and the attacker is introduced into a honeypot network including a plurality of simulation service nodes using the honeypot guidance strategy. This may include: when the attacker accesses the simulation information page, the attack behavior is determined based on the attacker's behavior on the simulation information page, and the honeypot guidance strategy is determined based on the attack behavior; a simulation service node is constructed based on the real business logic and data interaction mode corresponding to the target application industry, and the simulation service node is stored in the honeypot network; the simulation service node includes an induced behavior file corresponding to the corresponding application industry; each simulation service node in the honeypot network corresponds to a different application industry; and the attacker is introduced into the honeypot network based on the honeypot guidance strategy, so that the attacker determines the simulation service node to be accessed based on the corresponding application industry in the honeypot network.

[0063] Step S13: After the attacker accesses the simulated service node, record the attacker's portrait including the attacker's real network address and access behavior data, and then use the countermeasure strategy in the simulated service node and perform behavioral countermeasures based on the attacker's portrait.

[0064] In this embodiment, when an attacker accesses a honeypot network including several simulated service nodes based on a honeypot bootstrapping strategy, the attacker will further access multiple simulated target range honeypot nodes in the backend through an information leakage node. In this way, the honeypot system can record an attacker profile including the attacker's real network address and access behavior data. Specifically, after the attacker accesses the simulated service node, recording the attacker profile including the attacker's real network address and access behavior data can include: after the attacker accesses the simulated service node, using a preset information collector to collect system information corresponding to the attacker's terminal system and the attacker's corresponding behavior trajectory; when the attacker downloads an induced behavior file in the simulated service node, bundling the terminal system with the induced behavior file to obtain a bundling result; when the attacker attempts to establish a connection with the simulated service node, using a preset forged proxy service to record the attacker's network configuration information; when the attacker uses an attack tool to scan the simulated service node, using a preset tool built-in vulnerability in the simulated service node to obtain attack tool features corresponding to the attack tool; and determining the attacker profile based on the system information, behavior trajectory, bundling result, network configuration information, and attack tool features.

[0065] It is worth mentioning that different application fields correspond to different honeypot nodes, that is, the embodiment of the present application needs to target multiple customers in the same industry according to different honeypot nodes. In a specific embodiment, multiple honeypot embedding points are set in the target range node, wherein each honeypot embedding point contains different countermeasures, including but not limited to Chrome (Google Chrome, i.e. Google Chrome browser) browser countermeasures, object storage Trojan bundling, VPN (Virtual Private Network, i.e. virtual private network) Trojan bundling, hacker tool countermeasures and proxy tool countermeasures. Subsequently, after the attacker conducts a full-link penetration attack and post-penetration, the embodiment of the present application can construct a dynamic simulation IP through cluster containerization internally, so that the attacker is in a large intranet environment, and the attacker is induced to perform scanning attack behaviors and other post-penetration attacks through the constructed dense network environment, thereby capturing the attacker's complete portrait during the attacker's full-process attack. In a specific embodiment, the full process diagram of honeypot countermeasures is as follows: Figure 4 shown.

[0066] Specifically, utilizing the countermeasures in the simulated business nodes and performing behavioral countermeasures based on the attacker portrait can include: utilizing the preset cluster containerization technology to establish a simulated network address, and establishing an intranet environment based on the simulated network address, so as to limit the attacker's full-link penetration attack and post-penetration attack on the simulated business node to the intranet environment; utilizing various countermeasures in the simulated business nodes and performing behavioral countermeasures based on the attacker portrait; countermeasures include Chrome browser countermeasures, object storage Trojan bundling, VPN bundling Trojans, hacker tool countermeasures, and proxy tool countermeasures.

[0067] Alternatively, utilizing the countermeasure strategy in the simulation business node and performing behavioral countermeasures based on the attacker portrait may include: performing dimensional feature analysis on the attacker portrait to obtain a number of feature analysis results; the feature analysis results include behavioral pattern features, attack technical features, and intention motivation features corresponding to the attacker; determining a countermeasure strategy based on the behavioral pattern features, attack technical features, and intention motivation features, so as to use the countermeasure strategy to counter the attacker's attack behavior; collecting the attacker's behavioral data, and optimizing the countermeasure strategy based on the behavioral data, so as to use the optimized countermeasure strategy to counter the attacker's attack behavior.

[0068] Thus, the embodiment of the present application first needs to configure the attack routing rules in the preset reverse proxy server, and when the preset reverse proxy server receives the access request sent by the attacker, the access request is matched with the attack routing rules. If the match is successful, the access request is sent to the honeypot so that the honeypot sends the simulation information page determined based on the access request to the device interface corresponding to the attacker; the simulation information page is a page obtained by simulating the real business system based on Spring boot; then, when the attacker accesses the simulation information page, the honeypot guidance strategy is determined based on the attacker's attack behavior, and the honeypot guidance strategy is used to introduce the attacker into the honeypot network including several simulation business nodes; the simulation business node is a node that simulates the real business logic and data interaction method; finally, after the attacker accesses the simulation business node, the attacker portrait including the attacker's real network address and access behavior data is recorded, and then the countermeasure strategy in the simulation business node is used to perform behavioral countermeasures based on the attacker portrait. In this way, the efficiency of honeypot countermeasures is improved in the honeypot countermeasure process based on Spring boot, thereby improving the security of the production process.

[0069] Accordingly, see Figure 5 As shown, this application also provides a honeypot countermeasure device based on Spring Boot, including:

[0070] The simulation information page sending module 11 is used to configure the attack routing rules in the preset reverse proxy server, and when the preset reverse proxy server receives an access request sent by the attacker, match the access request with the attack routing rules. If the match is successful, the access request is sent to the honeypot, so that the honeypot sends the simulation information page determined based on the access request to the device interface corresponding to the attacker; the simulation information page is a page obtained by simulating the real business system based on Spring Boot;

[0071] A honeypot guidance strategy determination module 12 is configured to determine a honeypot guidance strategy based on the attacker's attack behavior when the attacker accesses the simulation information page, and use the honeypot guidance strategy to introduce the attacker into a honeypot network including a plurality of simulated service nodes; the simulated service nodes are nodes that simulate real service logic and data interaction methods;

[0072] The behavior countermeasure module 13 is used to record the attacker's portrait including the attacker's real network address and access behavior data after the attacker accesses the simulated business node, and then use the countermeasure strategy in the simulated business node and perform behavior countermeasure based on the attacker portrait.

[0073] As can be seen from the above, before the embodiment of the present application performs honeypot countermeasure based on Spring boot, it is necessary to configure attack routing rules in the preset reverse proxy server, and when the preset reverse proxy server receives the access request sent by the attacker, the access request is matched with the attack routing rules. If the match is successful, the access request is sent to the honeypot so that the honeypot sends the simulation information page determined based on the access request to the device interface corresponding to the attacker; the simulation information page is a page obtained by simulating the real business system based on Spring boot; then, when the attacker accesses the simulation information page, the honeypot guidance strategy is determined based on the attacker's attack behavior, and the honeypot guidance strategy is used to introduce the attacker into the honeypot network including several simulation business nodes; the simulation business node is a node that simulates real business logic and data interaction mode; finally, after the attacker accesses the simulation business node, the attacker portrait including the attacker's real network address and access behavior data is recorded, and then the countermeasure strategy in the simulation business node is used to perform behavioral countermeasure based on the attacker portrait. In this way, the efficiency of honeypot countermeasure is improved in the honeypot countermeasure process based on Spring boot, thereby improving the security of the production process.

[0074] In some specific implementations, the simulation information page sending module 11 may specifically include:

[0075] A reverse proxy server embedding unit is used to embed a preset reverse proxy server in the customer business system; the preset reverse proxy server is used to merge the simulation information page with the real business page;

[0076] An attack routing rule determination unit is configured to obtain a vulnerability fingerprint interface, a background scanning path, and a routing interface of the customer service system from a preset database, and determine an attack routing rule based on the vulnerability fingerprint interface, the background scanning path, and the routing interface of the customer service system;

[0077] An access request determining unit is configured to configure the attack routing rule in the preset reverse proxy server; the preset reverse proxy server is configured to receive the access request sent by the attacker; the preset reverse proxy server includes an Nginx reverse proxy server and a gateway routing reverse proxy server;

[0078] The access request judgment unit is used to judge whether the access request meets the preset request matching conditions when the preset reverse proxy server receives the access request sent by the attacker, and if the access request meets the preset request matching conditions, match the access request with the attack routing rule.

[0079] In some specific implementations, the simulation information page sending module 11 may specifically include:

[0080] a first to-be-processed simulation information page determining unit, configured to send the access request to a honeypot via a cloud honeypot portal, so that the honeypot determines the first to-be-processed simulation information page based on a framework type and version information corresponding to the access request; the cloud honeypot portal is a static page configured in the customer business system;

[0081] The second simulation information page to be processed determination unit is used to embed a token in the first simulation information page to be processed to obtain the second simulation information page to be processed, and then implant a sensitive data interface in the source code corresponding to the second simulation information page to be processed to obtain a device interface, so that the honeypot sends the simulation information page to the device interface corresponding to the attacker; the token is used to determine the honeypot level corresponding to the simulation information page; the sensitive data interface is used to induce the attacker to access.

[0082] In some specific implementations, the honeypot boot strategy determination module 12 may specifically include:

[0083] a honeypot boot strategy determining unit, configured to determine an attack behavior based on the attacker's behavior in the simulation information page when the attacker accesses the simulation information page, and determine a honeypot boot strategy based on the attack behavior;

[0084] A simulation business node construction unit is used to construct a simulation business node based on the real business logic and data interaction mode corresponding to the target application industry, and store the simulation business node in the honeypot network; the simulation business node includes an induced behavior file corresponding to the corresponding application industry; each simulation business node in the honeypot network corresponds to a different application industry;

[0085] The simulated service node determining unit is configured to introduce the attacker into the honeypot network based on the honeypot guiding strategy, so that the attacker determines the simulated service node to be accessed in the honeypot network based on the corresponding application industry.

[0086] In some specific implementations, the behavior countermeasure module 13 may specifically include:

[0087] a system information determining unit, configured to collect, after the attacker accesses the simulated service node, system information corresponding to the attacker's terminal system and a behavior trajectory corresponding to the attacker using a preset information collector;

[0088] a bundling result determining unit, configured to bundle the terminal system with the induced behavior file when the attacker downloads the induced behavior file in the simulated service node, to obtain a bundling result;

[0089] a network configuration information determining unit, configured to record the attacker's network configuration information by using a preset forged proxy service when the attacker attempts to establish a connection with the simulated service node;

[0090] an attack tool feature determination unit, configured to obtain an attack tool feature corresponding to the attack tool by utilizing a preset tool built-in vulnerability in the simulated service node when the attacker uses the attack tool to scan the simulated service node;

[0091] An attacker portrait determination unit is used to determine an attacker portrait based on the system information, the behavior trajectory, the bundling result, the network configuration information, and the attack tool characteristics.

[0092] In some specific implementations, the behavior countermeasure module 13 may specifically include:

[0093] An intranet environment establishment unit, configured to establish a simulated network address using a preset cluster containerization technology, and to establish an intranet environment based on the simulated network address, so as to limit the attacker's full-link penetration attack and post-penetration attack on the simulated service node to the intranet environment;

[0094] The first behavior countermeasure sub-unit is used to utilize the various countermeasure strategies in the simulated business node and perform behavior countermeasure based on the attacker portrait; the countermeasure strategies include Chrome browser countermeasure, object storage Trojan bundling, VPN bundling Trojan, hacker tool countermeasure and proxy tool countermeasure.

[0095] In some specific implementations, the behavior countermeasure module 13 may specifically include:

[0096] a feature analysis result determination unit, configured to perform dimensional feature analysis on the attacker profile to obtain a plurality of feature analysis results; the feature analysis results include behavioral pattern features, attack technique features, and intention motivation features corresponding to the attacker;

[0097] a countermeasure strategy determining unit, configured to determine a countermeasure strategy based on the behavior pattern characteristics, the attack technology characteristics, and the intention motivation characteristics, so as to counter the attacker's attack behavior using the countermeasure strategy;

[0098] The second behavior countermeasure subunit is used to collect the behavior data of the attacker and optimize the countermeasure strategy based on the behavior data, so as to counter the attack behavior of the attacker using the optimized countermeasure strategy.

[0099] Furthermore, the embodiment of the present application also discloses an electronic device, Figure 6This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram cannot be considered as any limitation on the scope of use of this application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input and output interface 25 and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the Spring boot-based honeypot countermeasure method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0100] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device. The communication protocol it follows is any communication protocol that can be applied to the technical solution of this application and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world. Its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0101] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or CD, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0102] The operating system 221 is used to manage and control the hardware devices and computer program 222 on the electronic device 20, and can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to implement the Spring Boot-based honeypot countermeasure method executed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0103] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when executed by a processor, the computer program implements the aforementioned Spring Boot-based honeypot countermeasure method. The specific steps of this method can be referred to the corresponding content disclosed in the aforementioned embodiments and will not be repeated here.

[0104] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from the other embodiments. Reference can be made to the descriptions of the identical or similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and the relevant parts can be referred to the descriptions of the methods.

[0105] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0106] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0107] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

[0108] The above is a detailed introduction to the technical solution provided by the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for those skilled in the art, according to the ideas of the present application, there may be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A honeypot countermeasure method based on Spring boot, characterized in that: include: Configuring attack routing rules in a preset reverse proxy server, and when the preset reverse proxy server receives an access request sent by an attacker, matching the access request with the attack routing rules, and if a match is successful, sending the access request to a honeypot, so that the honeypot sends a simulation information page determined based on the access request to a device interface corresponding to the attacker; The simulation information page is a page obtained by simulating the real business system based on Spring Boot; When the attacker accesses the simulation information page, a honeypot guidance strategy is determined based on the attacker's attack behavior, and the attacker is introduced into a honeypot network including a plurality of simulated service nodes using the honeypot guidance strategy; the simulated service nodes are nodes that simulate real service logic and data interaction mode; After the attacker accesses the simulated service node, an attacker portrait including the attacker's real network address and access behavior data is recorded, and then a countermeasure strategy in the simulated service node is used to perform behavioral countermeasures based on the attacker portrait.

2. The honeypot countermeasure method based on Spring Boot according to claim 1 is characterized in that: The configuring the attack routing rule in the preset reverse proxy server and matching the access request with the attack routing rule when the preset reverse proxy server receives an access request sent by the attacker includes: Embed a preset reverse proxy server in the customer's business system; the preset reverse proxy server is used to merge the simulation information page with the real business page; Obtaining a vulnerability fingerprint interface, a background scanning path, and a routing interface of the customer business system from a preset database, and determining an attack routing rule based on the vulnerability fingerprint interface, the background scanning path, and the routing interface of the customer business system; The attack routing rule is configured in the preset reverse proxy server; the preset reverse proxy server is used to receive the access request sent by the attacker; the preset reverse proxy server includes an Nginx reverse proxy server and a gateway routing reverse proxy server; When the preset reverse proxy server receives an access request sent by an attacker, it determines whether the access request meets the preset request matching condition. If the access request meets the preset request matching condition, the access request is matched with the attack routing rule.

3. The honeypot countermeasure method based on Spring Boot according to claim 2 is characterized in that: The sending of the access request to the honeypot so that the honeypot sends a simulation information page determined based on the access request to a device interface corresponding to the attacker, including: The access request is sent to the honeypot through a cloud honeypot portal, so that the honeypot determines a first simulation information page to be processed based on the framework type and version information corresponding to the access request; the cloud honeypot portal is a static page configured in the customer business system; A token is embedded in the first simulation information page to be processed to obtain a second simulation information page to be processed, and then a sensitive data interface is implanted in the source code corresponding to the second simulation information page to be processed to obtain a device interface, so that the honeypot can send the simulation information page to the device interface corresponding to the attacker; the token is used to determine the honeypot level corresponding to the simulation information page; the sensitive data interface is used to induce the attacker to access.

4. The honeypot countermeasure method based on Spring Boot according to claim 1 is characterized in that: When the attacker accesses the simulation information page, determining a honeypot guidance strategy based on the attacker's attack behavior, and using the honeypot guidance strategy to introduce the attacker into a honeypot network including a plurality of simulation service nodes, including: When the attacker accesses the simulation information page, determining an attack behavior based on the attacker's behavior in the simulation information page, and determining a honeypot booting strategy based on the attack behavior; Constructing a simulated business node based on the real business logic and data interaction mode corresponding to the target application industry, and storing the simulated business node in a honeypot network; the simulated business node includes an induced behavior file corresponding to the corresponding application industry; each simulated business node in the honeypot network corresponds to a different application industry; The attacker is introduced into the honeypot network based on the honeypot guiding strategy, so that the attacker determines the simulated service node to be accessed in the honeypot network based on the corresponding application industry.

5. The honeypot countermeasure method based on Spring Boot according to claim 4 is characterized in that: After the attacker accesses the simulated service node, recording an attacker profile including the attacker's real network address and access behavior data includes: After the attacker accesses the simulated service node, using a preset information collector to collect system information corresponding to the attacker's terminal system and the attacker's corresponding behavior trajectory; When the attacker downloads the induced behavior file in the simulated service node, bundling the terminal system with the induced behavior file to obtain a bundling result; When the attacker attempts to establish a connection with the simulated service node, the network configuration information of the attacker is recorded by using a preset forged proxy service; When the attacker uses an attack tool to scan the simulated service node, an attack tool feature corresponding to the attack tool is obtained by utilizing a preset tool built-in vulnerability in the simulated service node; An attacker profile is determined based on the system information, the behavior trajectory, the bundling result, the network configuration information, and the attack tool characteristics.

6. The honeypot countermeasure method based on Spring Boot according to claim 1 is characterized in that: The utilizing the countermeasure strategy in the simulated service node and performing behavioral countermeasures based on the attacker profile includes: Using a preset cluster containerization technology to establish a simulated network address, and establishing an intranet environment based on the simulated network address, so as to limit the attacker's full-link penetration attack and post-penetration attack on the simulated service node to the intranet environment; Utilize the various countermeasures in the simulated business node and perform behavioral countermeasures based on the attacker portrait; the countermeasures include Chrome browser countermeasures, object storage Trojan bundling, VPN bundling Trojans, hacker tool countermeasures, and proxy tool countermeasures.

7. The Spring Boot-based honeypot countermeasure method according to any one of claims 1 to 6, characterized in that: The utilizing the countermeasure strategy in the simulated service node and performing behavioral countermeasures based on the attacker profile includes: Performing dimensional feature analysis on the attacker profile to obtain several feature analysis results; the feature analysis results include behavioral pattern features, attack technique features, and intention motivation features corresponding to the attacker; Determining a countermeasure strategy based on the behavior pattern characteristics, the attack technology characteristics, and the intention motivation characteristics, so as to counter the attacker's attack behavior using the countermeasure strategy; The attacker's behavior data is collected, and the countermeasure strategy is optimized based on the behavior data, so as to counter the attacker's attack behavior using the optimized countermeasure strategy.

8. A honeypot countermeasure device based on Spring boot, characterized in that: include: A simulation information page sending module is used to configure an attack routing rule in a preset reverse proxy server, and when the preset reverse proxy server receives an access request sent by an attacker, match the access request with the attack routing rule. If a match is successful, the access request is sent to the honeypot, so that the honeypot sends a simulation information page determined based on the access request to the device interface corresponding to the attacker; The simulation information page is a page obtained by simulating the real business system based on Spring Boot; A honeypot boot strategy determination module is used to determine a honeypot boot strategy based on the attacker's attack behavior when the attacker accesses the simulation information page, and use the honeypot boot strategy to introduce the attacker into a honeypot network including a plurality of simulated business nodes; the simulated business nodes are nodes that simulate real business logic and data interaction methods; A behavior countermeasure module is used to record an attacker profile including the attacker's real network address and access behavior data after the attacker accesses the simulated business node, and then use the countermeasure strategy in the simulated business node to perform behavior countermeasures based on the attacker profile.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the Springboot-based honeypot countermeasure method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that Used to store a computer program, wherein when the computer program is executed by a processor, the Spring Boot-based honeypot countermeasure method according to any one of claims 1 to 7 is implemented.

Images