Honeypot deployment method and device, electronic equipment and computer program product

Abstract

The embodiment of the invention is suitable for the technical field of network security, and provides a honeypot deployment method and device, electronic equipment and a computer program product, and the method comprises the steps: obtaining network attack prediction data; performing principal component analysis on the network attack prediction data to determine security vulnerability features; according to the embodiment of the invention, principal component analysis is carried out on the network attack prediction data to determine the security vulnerability features, and the honeypot clusters are deployed for the security vulnerability features, so that abnormal behaviors can be predicted and found in time, the honeypot clusters are deployed for the security vulnerabilities which are vulnerable to attacks, and the security vulnerability detection efficiency is improved. And safe and stable operation of the network is ensured.

Description

Technical Field

[0001] The embodiments of the present application belong to the field of network security technology, and in particular, relate to a honeypot deployment method, device, electronic device, and computer program product. Background Art

[0002] Honeypot is an active defense technology that simulates vulnerable systems or services to attract potential attackers to attack them, thereby capturing, analyzing and studying attack behaviors.

[0003] With the rapid development of network technology, the variety of new network attack techniques continues to increase. Traditional honeypot technology has certain shortcomings in the face of existing attack patterns. How to solve the problems of honeypots such as insufficient system integration, insufficient camouflage performance, and low data collection and integration has become an urgent problem in the field of network security.

[0004] While traditional honeypot technology can attract attackers to a certain extent by exposing vulnerabilities and subsequently capturing and analyzing attack behaviors, it still has shortcomings in terms of handling attacks that do not target the honeypot and handling the aftermath of an attack. Furthermore, once the honeypot's fingerprint is revealed, attackers will avoid it and provide it with erroneous and false data, thereby misleading security managers and researchers. Summary of the Invention

[0005] In view of this, embodiments of the present application provide a honeypot deployment method, apparatus, electronic device, and computer program product for predicting vulnerable IoT security vulnerabilities and accurately deploying honeypots.

[0006] A first aspect of an embodiment of the present application provides a honeypot deployment method, including:

[0007] Obtain cyber attack prediction data;

[0008] Performing principal component analysis on the network attack prediction data to determine security vulnerability characteristics;

[0009] Deploy honeypot clusters according to the characteristics of each security vulnerability.

[0010] In some implementations of the first aspect, obtaining network attack prediction data includes:

[0011] Obtain historical data on network attacks;

[0012] Calling a preset time series model to predict the network attack historical data and generate network attack prediction data at at least one moment;

[0013] The network attack history data includes at least one of network attack history public information and network attack local log information.

[0014] In some implementations of the first aspect, the time series model is

[0015] Among them, Y t is the network attack prediction data at time t, c is the constant term vector, A i is the coefficient that represents the influence of each attack feature in the network attack prediction data on other attack features at the lag i moment, ∈ t represents the random error term at time t, and p is the number of lagged moments.

[0016] In some implementations of the first aspect, performing principal component analysis on the network attack prediction data to determine security vulnerability characteristics includes:

[0017] Performing data standardization processing on the network attack prediction data to generate prediction standard data;

[0018] Determining an original feature matrix corresponding to the prediction standard data; the original feature matrix is composed of attack features and time features;

[0019] determining a covariance matrix between different attack signatures;

[0020] Decomposing the covariance matrix to obtain corresponding eigenvalues and eigenvectors;

[0021] Determining an eigenvector matrix consisting of at least one eigenvector according to the magnitude of the eigenvalue;

[0022] Determining principal component scores based on the original feature matrix and the feature vector matrix;

[0023] The security vulnerability characteristics are determined based on the principal component scores.

[0024] In some implementations of the first aspect, deploying a honeypot cluster based on the security vulnerability feature includes:

[0025] Determine the honeypot deployment location corresponding to each of the security vulnerability characteristics;

[0026] For each of the honeypot deployment locations, a honeypot cluster is generated based on the honeypot response information of the security vulnerability characteristics.

[0027] In some implementations of the first aspect, the honeypot response information is

[0028] Among them, j is the honeypot identifier, fj (req) is the response rule of the j-th honeypot, g is the activation function, W j is the network attack result identifier, Z is the security vulnerability feature, and a is the security vulnerability feature weight.

[0029] In some implementations of the first aspect, the method further includes:

[0030] Identify pre-built intrusion detection systems;

[0031] Receiving suspicious behavior data sent by the intrusion detection system according to preset rule information;

[0032] Calling the honeypot cluster to respond to the suspicious behavior data;

[0033] The rule information includes attack pattern rules and abnormal traffic feature rules.

[0034] A second aspect of an embodiment of the present application provides a honeypot deployment device, including:

[0035] A prediction data acquisition module, used to obtain network attack prediction data;

[0036] A security vulnerability feature determination module is used to perform principal component analysis on the network attack prediction data to determine security vulnerability features;

[0037] The deployment module is used to deploy a honeypot cluster according to each of the security vulnerability features.

[0038] A third aspect of an embodiment of the present application provides an electronic device, comprising a processor, a memory, and a computer program stored in the memory and runnable on the processor. When the processor executes the computer program, the electronic device implements the honeypot deployment method as described in the first aspect above.

[0039] A fourth aspect of the embodiments of the present application provides a computer program product, including a computer program. When the computer program is run, the honeypot deployment method described in the first aspect is executed.

[0040] A fifth aspect of an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the honeypot deployment method as described in the first aspect above is implemented.

[0041] Compared with the prior art, the embodiments of the present application have the following beneficial effects:

[0042] In the embodiment of the present application, after obtaining network attack prediction data, principal component analysis is performed on the network attack prediction data to determine the security vulnerability characteristics, and then the security vulnerabilities that require honeypot deployment are determined based on the security vulnerability characteristics. A honeypot cluster is formed by setting corresponding honeypots for each security vulnerability in the network. Since different attack characteristics can be screened and the security vulnerability characteristics can be determined during the principal component analysis process, a controllable deep trapping environment is constructed. Honeypots can be deployed in different networks (including but not limited to heterogeneous Internet of Things) according to the method provided in the embodiment of the present application, so as to deploy highly interactive honeypot clusters in the corresponding networks for the security vulnerability characteristics obtained from the network attack prediction data, effectively trap and respond to global network attacks, and improve network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] To more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the embodiments or descriptions of the prior art. Obviously, the drawings described below are only some embodiments of the present application, and those skilled in the art can derive other drawings based on these drawings without inventive effort.

[0044] Figure 1 This is a schematic diagram of a honeypot deployment method provided by an embodiment of the present application;

[0045] Figure 2 This is a schematic diagram of another honeypot deployment method provided by an embodiment of the present application;

[0046] Figure 3 This is a schematic diagram of a honeypot deployment device provided in an embodiment of the present application;

[0047] Figure 4 This is a schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0048] In the following description, specific details such as specific system structures and techniques are provided for purposes of illustration rather than limitation to facilitate a thorough understanding of the embodiments of the present application. However, it will be apparent to those skilled in the art that the present application may be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to avoid obscuring the description of the present application with unnecessary detail.

[0049] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, integers, steps, operations, elements and / or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or collections thereof.

[0050] It will also be understood that the term "and / or" used in this specification and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0051] As used in this specification and the appended claims, the term "if" can be interpreted as "when" or "upon" or "in response to determining" or "in response to detecting," depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "upon determination" or "in response to determining" or "upon detection of [described condition or event]" or "in response to detecting [described condition or event]," depending on the context.

[0052] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0053] References to "one embodiment" or "some embodiments" in this specification mean that a particular feature, structure, or characteristic described in conjunction with that embodiment is included in one or more embodiments of the present application. Thus, phrases such as "in one embodiment," "in some embodiments," "in other embodiments," and "in other embodiments" appearing in various places in this specification do not necessarily refer to the same embodiment, but rather mean "one or more but not all embodiments," unless otherwise specifically emphasized. The terms "including," "comprising," "having," and variations thereof all mean "including but not limited to," unless otherwise specifically emphasized.

[0054] The technical solution of this application is described below through specific embodiments.

[0055] Reference Figure 1 , which shows a schematic diagram of a honeypot deployment method provided by an embodiment of the present application, which may specifically include the following steps:

[0056] Step 101: Obtain network attack prediction data;

[0057] Cyber attacks include various measures and behaviors that use special artificially designed computer programs or computer viruses and other means to weaken, damage or destroy the target computer network system, or reduce its effectiveness, such as physical spoofing and routing attacks.

[0058] A network attack can be the measures and actions taken by an attacking node (the device used by the attacker) against various networks such as local area networks, the Internet, and the Internet of Things.

[0059] The embodiments of the present application can predict network attacks on networks (including but not limited to the Internet of Things) that require the deployment of honeypots in a specified manner to obtain network attack prediction data.

[0060] The network attack prediction data may include different types of network attacks that may be suffered against one or more security vulnerabilities at one or more future moments.

[0061] Step 102: performing principal component analysis on the network attack prediction data to determine security vulnerability characteristics;

[0062] Principal component analysis is performed on network attack prediction data to identify the characteristics of security vulnerabilities that are susceptible to network attacks.

[0063] Cyberattacks have attack characteristics of different dimensions, such as attack type, attack intensity, and attack frequency. We can obtain cyberattack prediction data containing these characteristics and perform principal component analysis on them to determine the correlation between different attack characteristics and cyberattacks. We can then further process the cyberattack prediction data based on the magnitude of the correlation to identify the characteristics of security vulnerabilities that are susceptible to cyberattacks.

[0064] Step 103: deploy a honeypot cluster according to each of the security vulnerability features.

[0065] The corresponding location where the honeypot needs to be deployed is determined by the characteristics of the security vulnerability. The location can be a specific location in software or hardware, such as a certain executable code in a program, or a software interface corresponding to a physical interface. By deploying corresponding honeypots at one or more of these locations, a controllable deep trapping environment is constructed to attract network attacks to interact at a deeper level, thereby collecting richer attack information and potential threats, improving the interactivity of the honeypot, and enhancing the early warning and response to security vulnerabilities and network attacks, thereby ensuring the safe and stable operation of the network.

[0066] Taking the heterogeneous Internet of Things as an example, a heterogeneous Internet of Things typically includes multiple node devices, and different node devices can run different applications. Since a single honeypot's response, i.e., its ability to handle network attacks, typically has certain performance limitations (e.g., the number of network attacks it can handle per unit time), security vulnerabilities in the heterogeneous Internet of Things can be identified and honeypots deployed on an application-by-application basis. Since there are many nodes in a heterogeneous Internet of Things, honeypot clusters, i.e., honeypots in different locations corresponding to different applications, can be formed by setting up collaborative control nodes in the heterogeneous Internet of Things to uniformly control and manage each honeypot in the honeypot cluster, for example, updating honeypot response methods, adding new honeypots, etc.

[0067] In an embodiment of the present application, after obtaining network attack prediction data, principal component analysis is performed on the network attack prediction data to determine security vulnerability characteristics, and then the security vulnerabilities that require honeypot deployment are determined based on the security vulnerability characteristics. A honeypot cluster is formed by setting corresponding honeypots for each security vulnerability in the network. Since different attack characteristics can be screened and security vulnerability characteristics can be determined during the principal component analysis process, a controllable deep trapping environment is constructed. Honeypots can be deployed in different networks (including but not limited to heterogeneous Internet of Things) according to the method provided in the embodiment of the present application, so as to deploy highly interactive honeypot clusters in the corresponding networks for the security vulnerability characteristics obtained from the network attack prediction data, effectively trap and respond to global network attacks, and improve network security.

[0068] In some implementations of the embodiments of the present application, step 101 includes: obtaining network attack history data; calling a preset time series model to predict the network attack history data, and generating network attack prediction data for at least one moment; wherein the network attack history data includes at least one of network attack history public information and network attack local log information.

[0069] The method for obtaining network attack history data can be to integrate at least one of the following: local network attack log information from devices in the network where the honeypot is deployed, and public network attack history information in a public security database. For example, if there is no local network attack log information, the public network attack history information is used as the network attack history data; if the Internet of Things records local network attack log information, the local network attack log information and the public network attack history information are used as the network attack history data.

[0070] By predicting network attack history data including at least one of network attack history public information and network attack local log information and generating network attack prediction data, the accuracy of network attack prediction data is improved.

[0071] Since it is necessary to predict network attacks at future times, a corresponding time series model can be constructed before generating network attack prediction data. After extracting network attack-related features from the network attack historical data (for example, attack frequency, attack intensity, attack type, and attack time), the extracted features are input into the time series model to generate network attack prediction data through the time series model.

[0072] In some implementations of the embodiments of the present application, ARMA (Autoregressive Integrated Moving Average Model) can be used as a time series model. ARMA can automatically identify attack frequency, attack intensity and attack time. Therefore, the attack frequency, attack intensity and attack time can be input into ARMA, and the attack type is encoded (for example, one-hot encoding) and then input into ARMA. ARMA outputs the confidence interval of the predicted value of attack frequency, attack intensity and attack type in the future period, and generates network attack prediction data based on the predicted value of each confidence interval. In order to achieve prediction at multiple moments in the future, ARMA can be used to perform recursive loops for multi-step prediction. Thus, future attack behaviors are predicted and analyzed, and network attack prediction data of attack frequency, attack intensity and attack type are obtained based on the results of multi-step prediction (multiple moments).

[0073] In other implementations of the embodiments of the present application, since it is necessary to predict features of different dimensions of network attacks and multiple future moments, VAR (Vector Autoregressive Model) can be used as a time series model.

[0074] The time series model can be specifically

[0075] Among them, Y t is the network attack prediction data at time t, c is the constant term vector, A i is the coefficient that represents the influence of each attack feature in the network attack prediction data on other attack features at the lag i moment, ∈ t represents the random error term at time t, and p is the number of lagged moments.

[0076] Specifically, the attack frequency in historical network attack data is determined by recording the number of attacks that occurred within a certain period of time, the attack intensity is determined by the service interruption time caused, the attack type data is input into the model using one-hot encoding, and the timestamp directly records the time when the network attack behavior occurred. This information meets the conditions for using time series models for attack information analysis and network attack prediction.

[0077] The VAR model is used to integrate historical cyber attack data and predict future cyber attacks.

[0078] For time series models

[0079] Y t represents the observation value at time t, i.e., the network attack prediction data, Y tIndicates attack characteristics at multiple moments, such as attack frequency, attack intensity, and attack type.

[0080] c is a k×1 constant vector representing the baseline value of each time series variable, that is, the expected value when there are no other attack characteristics. For example, the expected values of attack frequency, attack intensity, and attack type when there are no other variables.

[0081] A i Is a k×k coefficient matrix, representing the coefficient matrix of the i-th lag coefficient, that is, A i It represents the impact of each attack feature on other attack features at the lag i time point.

[0082] ∈ t is a k×1 error term vector, i.e. white noise, ∈ t It represents the random error term at time point t, that is, the random fluctuations of attack frequency, attack intensity, and attack type that cannot be explained by the model.

[0083] p is the lag order, which indicates the number of lag moments processed in the model.

[0084] The historical attack data of IoT security vulnerabilities covers the frequency, intensity, type and timestamp of attacks, namely Y t-i The actual observed value of . Therefore, the time series model is used to predict the attacker's attack on the security vulnerabilities of heterogeneous IoT, and the obtained Y t is used for subsequent processing.

[0085] In some other implementations of the embodiments of the present application, step 102 includes: performing data standardization processing on the network attack prediction data to generate prediction standard data; determining an original feature matrix corresponding to the prediction standard data; the original feature matrix is composed of attack features and time features; determining a covariance matrix between different attack features; decomposing the covariance matrix to obtain mutually corresponding eigenvalues and eigenvectors; determining an eigenvector matrix composed of at least one eigenvector based on the size of the eigenvalue; determining a principal component score based on the original feature matrix and the eigenvector matrix; and determining a security vulnerability feature based on the principal component score.

[0086] After obtaining the network attack prediction data, the formula Standardize network attack prediction data.

[0087] Network prediction data Y t After data standardization, it is converted into prediction standard data Y s μ represents the mean and σ represents the standard deviation.

[0088] For example, network attack prediction data contains five moments (time features), and each moment has three attack features: attack frequency, attack intensity, and attack type.

[0089] The attack characteristics can be shown in Table 1:

[0090] Attack frequency 2 5 3 4 6 Attack Power 3.2 5.1 2.8 4.7 6.3 Attack Type 0 1 0 1 0

[0091] Table 1

[0092] After normalizing the values corresponding to the attack features, the data obtained are shown in Table 2:

[0093] Attack frequency -1.4142 0.7071 -0.7071 0 1.4142 Attack Power -1.736 0.531 -1.269 0.219 1.469 Attack Type -0.816 1.225 -0.816 1.225 -0.816

[0094] Table 2

[0095] The standardized data is used to construct a matrix to obtain a 5*3 original feature matrix, which is a matrix of 5 moments (time features) and 3 attack features. The matrix is:

[0096]

[0097] The covariance matrix is calculated based on the original feature matrix, and the eigenvalue decomposition of the covariance matrix is performed to obtain the eigenvalues and eigenvectors.

[0098] Taking the original feature matrix above as an example, the matrix contains the covariances between attack frequency, attack intensity, and attack type. The covariance between attack frequency and attack frequency is 1.25; the covariance between attack frequency and attack intensity is 1.452; the covariance between attack frequency and attack type is 0.361; the covariance between attack intensity and attack intensity is 1.778; the covariance between attack intensity and attack type is 0.543; and the covariance between attack type and attack type is 1.25.

[0099] From this we can get the covariance matrix:

[0100]

[0101] Perform eigenvalue decomposition on the covariance matrix to obtain eigenvalues and eigenvectors.

[0102] The three eigenvalues are: λ1 = 2.5, λ2 = 1.0, and λ3 = 0.778. The eigenvector corresponding to eigenvalue 1 (λ1) is: [0.6 0.6 0.5]. The eigenvector corresponding to eigenvalue 2 (λ2) is: [-0.8 0.4 0.4]. The eigenvector corresponding to eigenvalue 3 (λ3) is: [0.1 -0.7 0.7].

[0103] Based on the magnitude of the eigenvalues, an eigenvector matrix consisting of at least one eigenvector is determined. For example, a contribution rate can be pre-set, and the eigenvectors to be retained are determined based on the cumulative contribution rate of the eigenvalues, and the eigenvector matrix is constructed based on this. Specifically, the number of principal components to be retained is determined based on a threshold of the cumulative value of the variance of the attack signature to be explained. For example, if the contribution rate is set at 70%, the retained principal components can be considered to be representative of the information in the original data. The eigenvalue measures the amount of data variance that each principal component can explain. The larger the eigenvalue, the more information the principal component contains, that is, the principal component can explain the most variation in the data. The weight of the principal component is calculated by dividing the proportion of its variance by the cumulative variance. The cumulative contribution rate is the ratio of the sum of the eigenvalues of the first k principal components to the total sum of all eigenvalues, that is, how much information in the original data the first k principal components can explain.

[0104] Taking the above three eigenvalues as an example, if the contribution rate of the eigenvalues λ1 and λ2 reaches 70% or above, an eigenvector matrix is constructed based on the eigenvectors corresponding to the eigenvalues λ1 and λ2.

[0105] The principal component score calculation formula can be set in advance, and the principal component score can be generated based on the principal component score calculation formula, the original feature matrix, and the feature vector matrix.

[0106] As an example, the principal component score calculation formula is Z=Y s C, Z represent the principal component scores, Y s Represents the original feature matrix, and C represents the above-mentioned feature vector matrix.

[0107] Z is composed of multiple vectors, and at least some of the vectors in Z can be used as security vulnerability features.

[0108] In some other implementations of the embodiments of the present application, step 103 includes: determining a honeypot deployment location corresponding to each of the security vulnerability features; and generating a honeypot cluster based on honeypot response information of the security vulnerability features for each of the honeypot deployment locations.

[0109] After obtaining the security vulnerability characteristics through principal component analysis, the security vulnerabilities that are vulnerable to attack in the heterogeneous Internet of Things are determined based on the security vulnerability characteristics. The locations where honeypots need to be deployed are determined as honeypot deployment locations based on the security vulnerabilities. Honeypot response information containing security vulnerability characteristics is set at each honeypot deployment location to generate a honeypot cluster.

[0110] Since the honeypot response information contains security vulnerability features obtained from network attack prediction data, when the honeypot response information is called for response, a large amount of attack-related data can be processed more accurately.

[0111] In some other implementations of the embodiments of the present application, the honeypot response information is:

[0112]

[0113] Among them, j is the honeypot identifier, f j (req) is the response rule of the j-th honeypot, g is the activation function, W j is the network attack result identifier, Z is the security vulnerability feature, and a is the security vulnerability feature weight.

[0114] W=[W1,W2,...,W n ] is a weight vector, representing the response weight of the application. The response weight W represents the result obtained by the attacker. i =1, it means the desired result, W i =0 means it is not the desired result.

[0115] F=[f1(req),f2(req),...,f n (req)] is the response function vector, where f j (req) represents the response rule of the j-th honeypot.

[0116] Z=[z1,z2,...,z n ] is an additional feature vector, namely, the security vulnerability feature.

[0117] a=[a1,a2,...,a m ] is the weight vector of the additional features, i.e., the security vulnerability feature weight.

[0118] g is the activation function (sigmoid function), which maps the variable to between 0 and 1.

[0119] The honeypot response information adds a T The error term Z is used to describe the errors that cannot be explained by the model. Therefore, the optimized honeypot cluster response formula can more accurately process a large amount of attack data, and the optimized honeypot response information has more accurate results.

[0120] Reference Figure 2 , shows a schematic diagram of another honeypot deployment method provided by an embodiment of the present application, which may specifically include the following steps:

[0121] Step 201: Obtain network attack prediction data;

[0122] Step 202: performing principal component analysis on the network attack prediction data to determine security vulnerability characteristics;

[0123] Step 203: deploy a honeypot cluster according to each of the security vulnerability features;

[0124] Step 204, determining a pre-built intrusion detection system;

[0125] Step 205: receiving suspicious behavior data sent by the intrusion detection system according to preset rule information;

[0126] Step 206: calling the honeypot cluster to respond to the suspicious behavior data;

[0127] The rule information includes attack pattern rules and abnormal traffic feature rules.

[0128] In an embodiment of the present application, an intrusion detection system (IDS) that supports multiple custom rules (e.g., supporting at least 1,000 custom rules) can be determined based on the actual network conditions and requirements, and the IDS can be tightly integrated with the honeypot cluster via an application programming interface (API). For example, a RESTful API interface can be configured between the IDS and the honeypot cluster for real-time data exchange.

[0129] In order to improve the detection capability, the intrusion detection system is set with a number of attack pattern rules and abnormal traffic feature rules as rule information (for example: setting no less than 50 attack pattern rules and at least 20 abnormal traffic feature rules) so that the intrusion detection system can identify the data it receives according to the rule information and output suspicious behavior data.

[0130] The intrusion detection system can transmit at least several pieces of suspicious behavior data to the honeypot cluster every second, and encrypt the data transmitted to the honeypot cluster to ensure information security and prevent sensitive information from being leaked. For example, the intrusion detection system encrypts all data transmissions to the honeypot cluster through HTTPS (Hypertext Transfer Protocol Secure).

[0131] In order to improve the intrusion detection system's recognition of suspicious behavior data, a decision tree model can be pre-built in the intrusion detection system, and the decision tree model can be used to identify suspicious behavior data based on rule information.

[0132] As an example, the rules of the intrusion detection system support quantity, performance, cost and other characteristics to form a function h(a), and the minimization result h(a1)≥1000.

[0133] Integrate the API and set up a function mapping between the input of the honeypot cluster and the output of the IDS system to enable the intrusion detection system to transmit data to the honeypot cluster.

[0134] In the intrusion detection system, decision trees are used to make judgments based on known attack pattern rules and abnormal traffic feature rules. Specifically, a part of the above-mentioned network attack history data is used as labeled training data. The data contains known attack patterns and abnormal traffic features. The dataset D = {(x1, y1), (x2, y2), ..., (x n ,y n )}, x represents the feature vector, and y represents the category label.

[0135] Calculate the information entropy of the data set, K is the total number of categories, p k is the proportion of samples in the dataset D that belong to the kth category.

[0136] For feature A, its value set is V = {v1,v2,...,v m The information gain G(D,A) after the dataset D is divided by feature A is calculated as follows:

[0137]

[0138] D j The value of feature A in dataset D is v j A subset of |D j | is a subset D j The number of samples.

[0139] The feature with the largest information gain G is used as the node partition feature, feature A * To maximize the characteristics of G(D, A), that is:

[0140] A * =argmax A∈V G(D, A)

[0141] According to the selected feature A * The dataset D is divided into multiple subsets, and the above recursive process is performed on each subset until the height of the tree reaches the preset limit.

[0142] The decision tree T is represented as a recursive structure. Each non-leaf node corresponds to a feature A and a partitioning condition, and each leaf node corresponds to a category label k. The construction process of the decision tree is as follows: if the purity of the dataset D reaches the threshold or the height of the tree reaches the limit, a leaf node is created, and the category label of the leaf node is the category of the majority of samples in the dataset D; otherwise, the feature A with the largest information gain is selected. * As the partition feature of the current node. According to feature A * The value set V of the dataset D is divided into multiple subsets, and a subtree T is recursively constructed for each subset. j ,The child nodes of the current node are the constructed subtree, which accurately distinguishes normal data from suspicious data.

[0143] In an embodiment of the present application, after obtaining network attack prediction data, a principal component analysis is performed on the network attack prediction data to determine the characteristics of security vulnerabilities, and then the security vulnerabilities that need to deploy honeypots are determined based on the characteristics of the security vulnerabilities. A honeypot cluster is formed by setting corresponding honeypots for each security vulnerability in the network. Since different attack characteristics can be screened during the principal component analysis to determine the characteristics of the security vulnerability, a controllable deep trapping environment is constructed. The honeypot cluster can be further connected to the intrusion detection system. The intrusion detection system uses a decision tree to distinguish between abnormal traffic and normal traffic, and transmits the abnormal traffic to the honeypot cluster for response. By combining the honeypot cluster and the intrusion detection system, a reverse link WAF is reserved to prepare for the future expansion of a large number of network services. At the same time, building an intranet-integrated honeypot cluster can be used to defend against external penetration attacks on domains (or groups), further improving network security and the interactive performance of the honeypot cluster.

[0144] It should be noted that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0145] Reference Figure 3 , which shows a schematic diagram of a honeypot deployment device provided by an embodiment of the present application, which may specifically include:

[0146] Prediction data acquisition module 301, used to obtain network attack prediction data;

[0147] A security vulnerability feature determination module 302 is configured to perform principal component analysis on the network attack prediction data to determine security vulnerability features;

[0148] The deployment module 303 is used to deploy a honeypot cluster according to each of the security vulnerability features.

[0149] In some implementations of the embodiments of the present application, the prediction data acquisition module 301 includes:

[0150] The historical data acquisition submodule is used to obtain historical data of network attacks;

[0151] A prediction submodule, configured to use a preset time series model to predict the network attack historical data and generate network attack prediction data at at least one moment;

[0152] The network attack history data includes at least one of network attack history public information and network attack local log information.

[0153] In some implementations of the embodiments of the present application, the time series model is:

[0154]

[0155] Among them, Y t is the network attack prediction data at time t, c is the constant term vector, A i is the coefficient that characterizes the influence of each attack feature in the network attack prediction data on other attack features at the lag i moment, ∈ t represents the random error term at time t, and p is the number of lagged moments.

[0156] In some implementations of the embodiments of the present application, the security vulnerability feature determination module 302 includes:

[0157] A standardization submodule, configured to perform data standardization processing on the network attack prediction data to generate prediction standard data;

[0158] An original feature matrix generation module is used to determine an original feature matrix corresponding to the prediction standard data; the original feature matrix is composed of attack features and time features;

[0159] A covariance matrix determination submodule, used to determine the covariance matrix between different attack features;

[0160] A covariance matrix decomposition submodule, used to decompose the covariance matrix to obtain corresponding eigenvalues and eigenvectors;

[0161] an eigenvector matrix determination submodule, configured to determine an eigenvector matrix consisting of at least one eigenvector according to the magnitude of the eigenvalue;

[0162] A principal component score determination submodule, configured to determine a principal component score based on the original feature matrix and the feature vector matrix;

[0163] The security vulnerability feature determination submodule is used to determine the security vulnerability feature based on the principal component score.

[0164] In some implementations of the embodiments of the present application, the deployment module 304 includes:

[0165] A deployment location determination submodule, configured to determine a honeypot deployment location corresponding to each of the security vulnerability features;

[0166] The response information deployment submodule is used to deploy honeypot response information based on the security vulnerability characteristics for each honeypot deployment location to generate a honeypot cluster.

[0167] In some implementations of the embodiments of the present application, the honeypot response information is:

[0168]

[0169] Among them, j is the honeypot identifier, f j (req) is the response rule of the j-th honeypot, g is the activation function, W j is the network attack result identifier, Z is the security vulnerability feature, and a is the security vulnerability feature weight.

[0170] In some implementations of the embodiments of the present application, the apparatus further includes:

[0171] An intrusion detection system determination module, used for determining a pre-built intrusion detection system;

[0172] A behavior data receiving module, configured to receive suspicious behavior data sent by the intrusion detection system according to preset rule information;

[0173] A response module, configured to call the honeypot cluster to respond to the suspicious behavior data;

[0174] The rule information includes attack pattern rules and abnormal traffic feature rules.

[0175] An embodiment of the present application provides a honeypot deployment device, and by using this device, each step in the aforementioned method embodiments can be implemented.

[0176] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiment part.

[0177] Reference Figure 4 , shows a schematic diagram of an electronic device provided by an embodiment of the present application. Figure 4 As shown, the electronic device 400 in the embodiment of the present application includes: a processor 410, a memory 420, and a computer program 421 stored in the memory 420 and executable on the processor 410. When the processor 410 executes the computer program 421, the steps in each embodiment of the above honeypot deployment method are implemented, such as Figure 1 Alternatively, when the processor 410 executes the computer program 421, the functions of the modules / units in the above-mentioned device embodiments are realized, for example, Figure 3 Functions of modules 301 to 303 are shown.

[0178] Exemplarily, the computer program 421 may be divided into one or more modules / units, which are stored in the memory 420 and executed by the processor 410 to complete the present application. The one or more modules / units may be a series of computer program instruction segments capable of performing specific functions, which may be used to describe the execution process of the computer program 421 in the electronic device 400. For example, the computer program 421 may be divided into a prediction data acquisition module, a security vulnerability feature determination module, and a deployment module, with the specific functions of each module being as follows:

[0179] A prediction data acquisition module, used to obtain network attack prediction data;

[0180] A security vulnerability feature determination module is used to perform principal component analysis on the network attack prediction data to determine security vulnerability features;

[0181] The deployment module is used to deploy a honeypot cluster according to each of the security vulnerability features.

[0182] The electronic device 400 may be a desktop computer, a cloud server, an industrial device, or other device capable of running an application. The electronic device 400 may include, but is not limited to, a processor 410 and a memory 420. It will be understood by those skilled in the art that Figure 4 It is only an example of the electronic device 400 and does not constitute a limitation of the electronic device 400. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the electronic device 400 may also include input and output devices, network access devices, buses, etc.

[0183] The processor 410 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0184] The memory 420 may be an internal storage unit of the electronic device 400, such as a hard disk or memory of the electronic device 400. The memory 420 may also be an external storage device of the electronic device 400, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the electronic device 400. Furthermore, the memory 420 may include both an internal storage unit of the electronic device 400 and an external storage device. The memory 420 is used to store the computer program 421 and other programs and data required by the electronic device 400. The memory 420 may also be used to temporarily store data that has been output or is about to be output.

[0185] An embodiment of the present application further discloses a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program. When the computer program is executed by a processor, the honeypot deployment method as described in the aforementioned embodiments is implemented.

[0186] An embodiment of the present application further discloses a computer program product, including a computer program. When the computer program is executed, the honeypot deployment as described in the above embodiments is executed.

[0187] The above embodiments are intended only to illustrate the technical solutions of the present application and are not intended to limit them. Although the present application has been described in detail with reference to the above embodiments, a person skilled in the art should understand that the technical solutions described in the above embodiments may be modified or some of the technical features thereof may be replaced by equivalents; and such modifications or replacements do not deviate from the essence of the corresponding technical solutions within the scope of the technical solutions of the embodiments of the present application and should be included within the scope of protection of the present application.

Claims

1. A honeypot deployment method, characterized in that: include: Obtain cyber attack prediction data; Performing principal component analysis on the network attack prediction data to determine security vulnerability characteristics; Deploy honeypot clusters according to the characteristics of each security vulnerability.

2. The method according to claim 1, characterized in that The obtaining of network attack prediction data includes: Obtain historical data on network attacks; Calling a preset time series model to predict the network attack historical data and generate network attack prediction data at at least one moment; The network attack history data includes at least one of network attack history public information and network attack local log information.

3. The method according to claim 2, characterized in that The time series model is Among them, Y t is the network attack prediction data at time t, c is the constant term vector, A i is the coefficient that characterizes the influence of each attack feature in the network attack prediction data on other attack features at the lag i moment, ∈ t represents the random error term at time t, and p is the number of lagged moments.

4. The method according to claim 1, wherein The performing principal component analysis on the network attack prediction data to determine security vulnerability characteristics includes: Performing data standardization processing on the network attack prediction data to generate prediction standard data; Determining an original feature matrix corresponding to the prediction standard data; the original feature matrix is composed of attack features and time features; determining a covariance matrix between different attack signatures; Decomposing the covariance matrix to obtain corresponding eigenvalues and eigenvectors; Determining an eigenvector matrix consisting of at least one eigenvector according to the magnitude of the eigenvalue; Determining principal component scores based on the original feature matrix and the feature vector matrix; The security vulnerability characteristics are determined based on the principal component scores.

5. The method according to claim 1 or 4, characterized in that The deployment of a honeypot cluster targeting the security vulnerability characteristics includes: Determine the honeypot deployment location corresponding to each of the security vulnerability characteristics; For each of the honeypot deployment locations, a honeypot cluster is generated based on the honeypot response information of the security vulnerability characteristics.

6. The method according to claim 5, characterized in that The honeypot response information is Among them, j is the honeypot identifier, f j (req) is the response rule of the j-th honeypot, g is the activation function, W j is the network attack result identifier, Z is the security vulnerability feature, and a is the security vulnerability feature weight.

7. The method according to claim 1, characterized in that The method further comprises: Identify pre-built intrusion detection systems; Receiving suspicious behavior data sent by the intrusion detection system according to preset rule information; Calling the honeypot cluster to respond to the suspicious behavior data; The rule information includes attack pattern rules and abnormal traffic feature rules.

8. A honeypot deployment device, characterized in that: include: A prediction data acquisition module, used to obtain network attack prediction data; A security vulnerability feature determination module is used to perform principal component analysis on the network attack prediction data to determine security vulnerability features; The deployment module is used to deploy a honeypot cluster according to each of the security vulnerability features.

9. An electronic device, characterized in that: The electronic device comprises a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the electronic device implements the method according to any one of claims 1 to 7.

10. A computer program product, characterized in that The invention comprises a computer program, which, when being executed, enables the method according to any one of claims 1 to 7 to be performed.

Images