Attacker capturing method based on vulnerability counterfeiting

Abstract

The invention discloses an attacker capturing method based on vulnerability counterfeiting, and belongs to the technical field of vulnerability detection. Based on a preset basic supervision period, supervision and data analysis in different aspects are carried out on an attacker capture scheme implementation process, and local implementation positive supervision data and local implementation negative supervision data obtained through supervision in the basic supervision period are integrated, processed and analyzed. Dynamic optimization management is carried out on subsequent implementation of the attacker capturing scheme according to the local application effect; monitoring, processing and analyzing the capture optimization effect of the attacker capture scheme subjected to optimization management, and performing secondary optimization management on the optimized attacker capture scheme according to the processing and analysis result; the method is used for solving the technical problems that in an existing scheme, the local implementation supervision effect and the overall application effect in different aspects in the attacker capture scheme implementation process are poor, and the self-adaptive optimization management effect is poor.

Description

Technical Field

[0001] The present invention relates to the technical field of vulnerability detection, and in particular to a method for capturing an attacker based on vulnerability forgery. Background Art

[0002] Attacker hunting based on vulnerability forgery usually refers to the use of deception technology to detect and defend against network attacks. The core idea is to set traps or bait to attract attackers to interact, thereby revealing their attack behaviors, tools and strategies.

[0003] When implementing existing attacker capture solutions, it is impossible to supervise different aspects of the attacker capture solution implementation process and conduct data analysis, determine the positive and negative results corresponding to the attacker capture solution, and conduct an integrated analysis of the application effects of the attacker capture solution based on the different effects obtained, and adaptively perform dynamic optimization management of the attacker capture solution based on the integrated analysis results. There are problems such as poor local implementation supervision effects and overall application effects in different aspects of the attacker capture solution implementation process, as well as poor adaptive optimization management effects. Summary of the Invention

[0004] The purpose of the present invention is to provide an attacker capture method based on vulnerability forgery, which is used to solve the technical problems of poor local implementation supervision effect and overall application effect in different aspects of the attacker capture solution implementation process in existing solutions, as well as poor adaptive optimization management effect.

[0005] The purpose of the present invention can be achieved through the following technical solutions:

[0006] An attacker capture method based on vulnerability forging, comprising:

[0007] Based on the preset basic supervision cycle, the attacker capture program implementation process is supervised in different aspects and data analyzed to obtain local positive supervision data and local negative supervision data corresponding to the attacker capture program implementation process;

[0008] Integrate and analyze the local positive and negative regulatory data obtained during the basic regulatory cycle to determine the local application effects of the attacker capture plan implemented during the basic regulatory cycle, and dynamically optimize the subsequent implementation of the attacker capture plan based on the local application effects;

[0009] The optimization effect of the attacker capture plan after the optimization management is implemented is supervised and analyzed, and the optimized attacker capture plan is maintained and implemented in the future according to the results of the processing and analysis, or the optimized attacker capture plan is optimized for the second time.

[0010] Preferably, when monitoring and counting all captured data during the implementation of the attacker capture scheme based on a preset basic monitoring cycle, the attacked target, capture confirmation result and capture resource value in different capture data are obtained; the capture confirmation result includes capture confirmation valid and capture confirmation invalid;

[0011] Sorting and combining all the capture data according to the same capture confirmation result that is valid to obtain first capture classification data;

[0012] Furthermore, all the capture data belonging to the same capture confirmation result of invalid capture confirmation are sorted and combined to obtain second capture classification data.

[0013] Preferably, when performing data analysis in different aspects based on the first captured classification data and the second captured classification data, the first captured classification data is analyzed by the local positive influence formula Calculate and obtain the corresponding local active supervision value JJ; where NZ is the total number of all captured data in the first capture classification data; NY is the total number of all captured data in the second capture classification data.

[0014] Preferably, the second captured classification data is passed through the local negative influence formula Calculate and obtain the corresponding local negative regulation value JX; where ZBi is the capture resource value associated with different capture data in the second capture classification data; i is different capture data in the second capture classification data, i = 1, 2, 3, ..., NY; ZB0 is the total capture resource value associated with all capture data in the basic regulation period;

[0015] The locally implemented positive regulatory value is associated with the first captured classification data to obtain the locally implemented positive regulatory data corresponding to the basic regulatory cycle, and the locally implemented negative regulatory value is associated with the second captured classification data to obtain the locally implemented negative regulatory data corresponding to the basic regulatory cycle.

[0016] Preferably, the locally implemented positive supervision value in the locally implemented positive supervision data and the locally implemented negative supervision value in the locally implemented negative supervision data are calculated by the formula Calculate and obtain the local implementation supervision difference c; where η is the standard value of the local implementation supervision difference corresponding to the attacker's capture scheme in the basic supervision cycle;

[0017] In addition, the calculated local implementation supervision difference is subjected to data analysis through the local implementation effect identification model, and the local application validity YX corresponding to the attacker capture plan within the basic supervision cycle is output; the local application validity includes values of -1, 0 or 1.

[0018] Preferably, the expression of the local implementation effect identification model is Where b is the value of the local supervision condition.

[0019] Preferably, the local application validity value of -1 indicates that the local application effect of the attacker capture solution in the basic supervision cycle is normal;

[0020] According to the local application validity value of 0, it is suggested that the local application effect of the attacker capture program in the basic supervision cycle is slightly abnormal, and the first optimization management of the attacker capture program is implemented;

[0021] According to the local application validity with a value of 1, it is suggested that the local application effect of the attacker capture program within the basic supervision cycle is severely abnormal, and the second optimization management of the attacker capture program is implemented.

[0022] Preferably, the local positive supervision value, local negative supervision value and local supervision difference of the attacker capture scheme after the optimized management are obtained in the corresponding supervision cycle, and the formula Calculate the local implementation optimization validity SYX of the attacker capture scheme after the implementation of optimized management; where c′ is the local implementation supervision difference of the attacker capture scheme in the corresponding supervision cycle after the implementation of optimized management; K is a real number greater than 0 and less than 100; is the floor function.

[0023] Preferably, data analysis is performed on the local optimization effectiveness. If the local optimization effectiveness is less than or equal to 0, it is determined that the capture optimization effect of the attacker capture scheme after the optimization management is implemented is normal, and the optimized attacker capture scheme is maintained and subsequently implemented;

[0024] If the local optimization validity is greater than 0, it is determined that the attacker capture scheme after the optimization management is implemented has an abnormal capture optimization effect, and the optimized attacker capture scheme is subject to secondary optimization management;

[0025] Preferably, when performing the secondary optimization management, if the local optimization validity is 1, the first optimization management is continued to be performed on the attacker capture scheme after the optimization management is implemented;

[0026] If the local optimization validity is greater than 1, the second optimization management is continued to be implemented on the attacker capture plan after the optimization management is implemented.

[0027] Compared with the existing solutions, the present invention achieves the following beneficial effects:

[0028] The present invention supervises different aspects of the implementation process of the attacker capture plan and conducts data analysis based on a preset basic supervision cycle. It can digitally process and classify the local implementation supervision status corresponding to the attacker capture plan within the basic supervision cycle from the dimension of implementing positive results and the dimension of implementing negative results. It can provide reliable multi-dimensional local implementation supervision analysis data support for the data analysis of the local application effects corresponding to the implementation of the attacker capture plan in subsequent basic supervision cycles, thereby improving the local implementation supervision effects of different aspects of the implementation process of the attacker capture plan.

[0029] The present invention integrates and analyzes the local active supervision data and the local passive supervision data obtained in the early stage, obtains the local application effect corresponding to the implementation of the attacker capture plan within the basic supervision cycle, and dynamically optimizes and manages the subsequent implementation of the attacker capture plan based on the local application effect, thereby realizing the supervision analysis and targeted optimization management of the implementation effect of the attacker capture plan from an overall dimension, improving the overall application effect of different aspects of the implementation process of the attacker capture plan and adaptively optimizing the management effect.

[0030] The present invention further improves the autonomous supervision effect and autonomous improvement effect of the adaptive optimization management of the attacker capture scheme by supervising and processing the optimization effect of the attacker capture scheme after the optimization management is implemented, and performing secondary optimization management on the optimized attacker capture scheme according to the processing and analysis results. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] The present invention will be further described below with reference to the accompanying drawings.

[0032] Figure 1 The present invention is a flowchart of an attacker capture method based on vulnerability forgery.

[0033] Figure 2 This is a flowchart of the data analysis for local optimization validity in the present invention. DETAILED DESCRIPTION

[0034] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0035] like Figure 1 As shown, the present invention is a method for capturing an attacker based on vulnerability forgery, comprising:

[0036] Based on the preset basic supervision cycle, the attacker capture program implementation process is supervised in different aspects and data analyzed to obtain local positive supervision data and local negative supervision data corresponding to the attacker capture program implementation process; including:

[0037] When monitoring and statistics are collected for all captured data during the implementation of the attacker capture solution based on a preset basic monitoring cycle, the unit of the basic monitoring cycle is days. The specific unit can be 15 days, or it can be customized according to the actual application requirements of the actual application scenario to obtain the attacked targets, capture confirmation results, and capture resource values in different capture data;

[0038] The attacked targets may specifically be several pre-forged vulnerabilities;

[0039] The capture confirmation result includes capture confirmation valid and capture confirmation invalid; the capture confirmation result can be determined by professional operation and maintenance personnel in this field;

[0040] The capture resource value can be, for example, CPU usage, which refers to the percentage of time the central processing unit (CPU) spends processing the task of capturing the attacker; or total network bandwidth usage, which refers to the total network traffic generated from the start to the end of the capture process. This can be determined based on the actual application requirements of the actual application scenario.

[0041] Sorting and combining all the capture data according to the same capture confirmation result that is valid to obtain first capture classification data;

[0042] and, sorting and combining all the capture data according to the same capture confirmation result of invalid capture confirmation to obtain second capture classification data;

[0043] In the embodiment of the present invention, by processing and classifying all captured data appearing in the basic supervision cycle, reliable captured classification data support can be provided for subsequent data analysis in different aspects;

[0044] When performing data analysis in different aspects based on the first capture classification data and the second capture classification data, the first capture classification data is analyzed by the local positive influence formula. Calculate and obtain the corresponding local active supervision value JJ; where NZ is the total number of all captured data in the first capture classification data; NY is the total number of all captured data in the second capture classification data;

[0045] And the second capture classification data is passed through the local negative impact formula Calculate and obtain the corresponding local negative regulation value JX; where ZBi is the capture resource value associated with different capture data in the second capture classification data; i is different capture data in the second capture classification data, i = 1, 2, 3, ..., NY; ZB0 is the total capture resource value associated with all capture data in the basic regulation period;

[0046] It should be noted that the local implementation positive supervision value and the local implementation negative supervision value are calculated from the data of the implementation positive result dimension and the implementation negative result dimension respectively, so as to digitally represent the local implementation supervision status corresponding to different dimensions;

[0047] Correlating and combining the locally implemented positive regulatory value with the first captured classification data to obtain locally implemented positive regulatory data corresponding to the basic regulatory period, and correlating and combining the locally implemented negative regulatory value with the second captured classification data to obtain locally implemented negative regulatory data corresponding to the basic regulatory period;

[0048] In an embodiment of the present invention, different aspects of the implementation process of the attacker capture scheme are supervised and data analyzed based on a preset basic supervision cycle, which can realize digital processing and classification of the local implementation supervision status corresponding to the attacker capture scheme within the basic supervision cycle from the dimension of implementing positive results and the dimension of implementing negative results. It can provide reliable multi-dimensional local implementation supervision analysis data support for the data analysis of the local application effects corresponding to the implementation of the attacker capture scheme in subsequent basic supervision cycles, thereby improving the local implementation supervision effects of different aspects of the implementation process of the attacker capture scheme.

[0049] Integrate and analyze the local positive and negative regulatory data obtained during the basic regulatory cycle to determine the local application effects of the attacker capture plan implemented during the basic regulatory cycle, and dynamically optimize the subsequent implementation of the attacker capture plan based on the local application effects; including:

[0050] The local positive supervision value in the local positive supervision data and the local negative supervision value in the local negative supervision data are calculated by the formula Calculate and obtain the local implementation supervision difference c; where η is the standard value of the local implementation supervision difference corresponding to the attacker capture scheme in the basic supervision cycle, which can be determined based on the design requirements data of the attacker capture scheme or the early test data of the attacker capture scheme;

[0051] It should be noted that the local implementation supervision difference is used to calculate the local implementation supervision data of different dimensions corresponding to the attacker capture scheme within the basic supervision cycle, so as to digitally represent the corresponding local implementation supervision status;

[0052] In the embodiment of the present invention, by integrating and calculating the supervisory processing data of different aspects of the early attacker capture scheme implementation process, the local implementation supervisory data corresponding to different dimensions in the early stage is expanded and utilized;

[0053] Furthermore, the calculated local implementation supervision difference is analyzed through the local implementation effect identification model, and the local application validity YX corresponding to the attacker capture scheme within the basic supervision cycle is output;

[0054] Among them, the expression of the local implementation effect identification model is: Where b is the local implementation supervision condition value, which can be determined based on the design requirement data of the attacker's capture scheme;

[0055] Local application validity contains values of -1, 0, or 1;

[0056] A local application validity of -1 indicates that the local application effect of the attacker capture solution in the basic supervision cycle is normal;

[0057] A local application validity of 0 indicates that the local application effect of the attacker capture scheme in the basic supervision cycle is slightly abnormal;

[0058] A local application validity of -1 indicates that the local application effect of the attacker capture scheme during the basic supervision cycle is severely abnormal;

[0059] The local application validity value of -1 indicates that the attacker capture solution has a normal local application effect during the basic supervision cycle;

[0060] According to the local application validity value of 0, it is suggested that the local application effect of the attacker capture program in the basic supervision cycle is slightly abnormal, and the first optimization management of the attacker capture program is implemented;

[0061] According to the local application validity with a value of 1, it is indicated that the local application effect of the attacker capture program in the basic supervision cycle is severely abnormal, and the second optimization management of the attacker capture program is implemented;

[0062] Among them, the first optimization management is to update and improve the design rules for vulnerability forgery attack capture to reduce the impact of abnormal operations caused by false positives. The specific attack capture design rules can be determined by combining the existing honeypot and honeynet design rules;

[0063] Second, optimized management involves updating and improving the design rules for vulnerability forgery attack capture, as well as shortening the basic monitoring cycle to implement targeted periodic supervision. The shortened period can be as short as 7 days. This means optimizing management from both the capture implementation and the capture implementation supervision aspects.

[0064] In an embodiment of the present invention, by integrating and analyzing the local active supervision data and the local passive supervision data obtained in the early stage, the local application effect corresponding to the implementation of the attacker capture plan within the basic supervision cycle is obtained, and the subsequent implementation of the attacker capture plan is dynamically optimized and managed based on the local application effect, thereby realizing the supervision analysis and targeted optimization management of the implementation effect of the attacker capture plan from an overall dimension, improving the overall application effect of different aspects of the implementation process of the attacker capture plan and adaptively optimizing the management effect.

[0065] Supervise and analyze the optimization results of the attacker capture plan after the optimization management is implemented, and maintain the optimized attacker capture plan for subsequent implementation based on the results of the analysis, or conduct secondary optimization management on the optimized attacker capture plan; including:

[0066] Obtain the local positive supervision value, local negative supervision value and local supervision difference of the attacker capture scheme after the implementation of optimized management in the corresponding supervision cycle, and use the formula Calculate and obtain the first local implementation optimization validity SYX after the attacker capture scheme is optimized. Where c′ is the local implementation supervision difference of the attacker capture scheme in the corresponding supervision cycle after the optimization management is implemented. It can be determined based on the design requirement data of the attacker capture scheme or the early test data of the attacker capture scheme. K is a real number greater than 0 and less than 100, and a specific value can be 60. is the floor function;

[0067] It should be noted that the local implementation optimization validity is used to calculate the periodic implementation supervision data after the attacker capture plan is optimized and managed, so as to digitally represent the capture optimization effect of the attacker capture plan;

[0068] Furthermore, the local implementation supervision difference of the attacker capture scheme after the optimized management is implemented in the corresponding supervision cycle is analyzed through the local implementation effect identification model, and the corresponding second local implementation optimization validity is output;

[0069] Unlike existing technical solutions that only conduct retrospective analysis of optimization effects based on a single aspect of retrospective supervision data, which suffers from poor accuracy of retrospective analysis and poor reliability of optimization management, the embodiments of the present invention effectively reduce errors in data processing and analysis by monitoring and processing the optimization effect data of different aspects of the attacker capture solution after optimization management within the corresponding supervision cycle, thereby improving the reliability and diversity of the secondary optimization management of the attacker capture solution after optimization management.

[0070] like Figure 2As shown, data analysis is performed on the first partial implementation optimization validity and the second partial implementation optimization validity. If the first partial implementation optimization validity and the second partial implementation optimization validity are both less than or equal to 0, it is determined that the capture optimization effect of the attacker capture scheme after the implementation of the optimized management is normal, and the optimized attacker capture scheme is maintained and continued to be implemented;

[0071] If one of the first partial optimization validity and the second partial optimization validity is greater than 0, it is determined that the capture optimization effect of the attacker capture scheme after the optimization management is abnormal, and the optimized attacker capture scheme is subject to secondary optimization management;

[0072] Among them, when performing the secondary optimization management, if only one of the first local optimization validity and the second local optimization validity is 1, then the first optimization management will continue to be implemented on the attacker capture plan after the optimization management is implemented;

[0073] If the first partial optimization validity and the second partial optimization validity are both greater than 1, the second optimization management is continued to be implemented on the attacker capture solution after the optimization management is implemented.

[0074] Different from the existing technical solutions, which do not retrospectively analyze and improve the effects of the attacker capture scheme after optimization, in the embodiment of the present invention, the optimization effect of the attacker capture scheme after optimization management is supervised and processed and analyzed, and the optimized attacker capture scheme is secondary optimized according to the processing and analysis results, thereby further improving the autonomous supervision effect and autonomous improvement effect of the adaptive optimization management of the attacker capture scheme.

[0075] In addition, the formulas involved in the above are all calculated by removing dimensions and taking their numerical values. They are a formula that is closest to the actual situation obtained by collecting a large amount of data and simulating it through simulation software.

[0076] In the several embodiments provided by the present invention, it should be understood that the disclosed methods can be implemented in other ways. For example, the above-described embodiments of the invention are merely illustrative. For example, the division of modules is only a logical function division, and other division methods may be used in actual implementation.

[0077] Modules described as separate components may or may not be physically separate, and components shown as modules may or may not be physical modules, and may be located in one place or distributed across multiple network modules. Some or all of these modules may be selected to achieve the objectives of this embodiment based on actual needs.

[0078] In addition, the functional modules in various embodiments of the present invention may be integrated into a single processing module, each module may exist physically separately, or two or more modules may be integrated into a single module. The aforementioned integrated modules may be implemented in the form of hardware or hardware plus software functional modules.

[0079] It is obvious to a person skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, but that the present invention can be implemented in other specific forms without departing from the essential characteristics of the present invention.

[0080] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not limiting. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. A method for capturing an attacker based on vulnerability forgery, characterized in that: include: Based on the preset basic supervision cycle, the attacker capture program implementation process is supervised in different aspects and data analyzed to obtain local positive supervision data and local negative supervision data corresponding to the attacker capture program implementation process; Integrate and analyze the local positive and negative regulatory data obtained during the basic regulatory cycle to determine the local application effects of the attacker capture plan implemented during the basic regulatory cycle, and dynamically optimize the subsequent implementation of the attacker capture plan based on the local application effects; The optimization effect of the attacker capture plan after the optimization management is implemented is supervised and analyzed, and the optimized attacker capture plan is maintained and implemented in the future according to the results of the processing and analysis, or the optimized attacker capture plan is optimized for the second time.

2. The method for capturing an attacker based on vulnerability forgery according to claim 1, characterized in that: When monitoring and counting all captured data during the implementation of the attacker's capture scheme based on a preset basic monitoring cycle, the attacked target, capture confirmation result, and capture resource value in different capture data are obtained; The capture confirmation result includes capture confirmation valid and capture confirmation invalid; Sorting and combining all the capture data according to the same capture confirmation result that is valid to obtain first capture classification data; Furthermore, all the capture data belonging to the same capture confirmation result of invalid capture confirmation are sorted and combined to obtain second capture classification data.

3. The method for capturing an attacker based on vulnerability forgery according to claim 2, characterized in that: When performing data analysis in different aspects based on the first capture classification data and the second capture classification data, the first capture classification data is analyzed by the local positive influence formula. Calculate and obtain the corresponding local active supervision value JJ; where NZ is the total number of all captured data in the first capture classification data; NY is the total number of all captured data in the second capture classification data.

4. The method for capturing an attacker based on vulnerability forgery according to claim 3, wherein: The second capture classification data is passed through the local negative impact formula Calculate and obtain the corresponding local negative regulation value JX; where ZBi is the capture resource value associated with different capture data in the second capture classification data; i is different capture data in the second capture classification data, i = 1, 2, 3, ..., NY; ZB0 is the total capture resource value associated with all capture data in the basic regulation period; The locally implemented positive regulatory value is associated with the first captured classification data to obtain the locally implemented positive regulatory data corresponding to the basic regulatory cycle, and the locally implemented negative regulatory value is associated with the second captured classification data to obtain the locally implemented negative regulatory data corresponding to the basic regulatory cycle.

5. The method for capturing an attacker based on vulnerability forgery according to claim 4, characterized in that: The local positive supervision value in the local positive supervision data and the local negative supervision value in the local negative supervision data are calculated by the formula Calculate the local implementation supervision difference c; where η is the standard value of the local implementation supervision difference corresponding to the attacker's capture scheme in the basic supervision cycle; In addition, the calculated local implementation supervision difference is subjected to data analysis through the local implementation effect identification model, and the local application validity YX corresponding to the attacker capture plan within the basic supervision cycle is output; the local application validity includes values of -1, 0 or 1.

6. The method for capturing an attacker based on vulnerability forgery according to claim 5, characterized in that: The expression of the local implementation effect identification model is: Where b is the value of the local implementation supervision condition.

7. The method for capturing an attacker based on vulnerability forgery according to claim 5, characterized in that: The local application validity value of -1 indicates that the attacker capture solution has a normal local application effect during the basic supervision cycle; According to the local application validity value of 0, it is suggested that the local application effect of the attacker capture program in the basic supervision cycle is slightly abnormal, and the first optimization management of the attacker capture program is implemented; According to the local application validity with a value of 1, it is suggested that the local application effect of the attacker capture program within the basic supervision cycle is severely abnormal, and the second optimization management of the attacker capture program is implemented.

8. The method for capturing an attacker based on vulnerability forgery according to claim 7, characterized in that: Obtain the local positive supervision value, local negative supervision value and local supervision difference of the attacker capture scheme after the implementation of optimized management in the corresponding supervision cycle, and use the formula Calculate the local implementation optimization validity SYX of the attacker capture scheme after the implementation of optimized management; where c′ is the local implementation supervision difference of the attacker capture scheme in the corresponding supervision cycle after the implementation of optimized management; K is a real number greater than 0 and less than 100; is the floor function.

9. The method for capturing an attacker based on vulnerability forgery according to claim 8, characterized in that: Perform data analysis on the local optimization effectiveness. If the local optimization effectiveness is less than or equal to 0, it is determined that the attacker capture scheme after the optimization management is implemented has a normal capture optimization effect, and the optimized attacker capture scheme is maintained and continued to be implemented; If the local optimization validity is greater than 0, it is determined that the capture optimization effect of the attacker capture scheme after the optimization management is implemented is abnormal, and the optimized attacker capture scheme is subjected to secondary optimization management.

10. The method for capturing an attacker based on vulnerability forgery according to claim 9, characterized in that: When performing secondary optimization management, if the local optimization validity is 1, the attacker capture plan after the optimization management is implemented will continue to be subject to the first optimization management; If the local optimization validity is greater than 1, the second optimization management is continued to be implemented on the attacker capture plan after the optimization management is implemented.

Images