Batch mining honeypot fingerprint and identification method and system

Abstract

The application provides a batch honey pot fingerprint mining and identification method and system, comprising the following steps: S1, constructing a large number of different requests according to the protocol implemented by the honey pot; S2, building instances and sending requests to the instances, and recording the replies; S3, for a request, the replies obtained by different instances are called a group of replies, and an extended cosine value is calculated for each group of replies; S4, according to the extended cosine value, screening the group with the largest difference, and forming a fingerprint together with the corresponding request; S5, using the fingerprint to detect unknown instances to obtain the possibility that the unknown instances are honey pots. The application can quickly extract a large number of fingerprints without deep interaction with the instances, and has the characteristics of high efficiency and practicability.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a method and system for batch mining and identifying honeypot fingerprints. More particularly, it relates to a method for batch mining and identifying honeypot fingerprints based on request construction and response filtering. Background Technology

[0002] I. Honey Pot

[0003] A honeypot is a type of network security defense technique. It typically simulates a specific vulnerable system to lure attackers, aiming to delay attacks and collect attacker information. A honeypot has three main components, summarized as data control, data capture, and data collection, corresponding to its three functions: deceiving attackers to protect the system, capturing data, and securely collecting data at a central location.

[0004] There are many criteria for classifying honeypots. Based on their level of interactivity, they can be divided into low-interaction honeypots, medium-interaction honeypots, and high-interaction honeypots.

[0005] 1. Low-interaction honeypots: These are fake systems that only provide the bare minimum of functionality. They are isolated from the real production environment, so even if attacked, they will not harm other real systems. However, because they only guarantee the bare minimum, they are often detected as honeypots before more detailed attacker information can be recorded. Low-interaction honeypots have the advantages of low cost, ease of maintenance, ease of implementation, and high scalability, but they are also easily identified.

[0006] 2. Medium-interaction honeypots: Similar to low-interaction honeypots, medium-interaction honeypots only implement some of the real system's functions. However, compared to low-interaction honeypots, they are better disguised and can prolong the time it takes for attackers to discover them.

[0007] 3. Highly Interactive Honeypots: Highly interactive honeypots implement all the functionalities found in real systems, meaning attackers can use them to compromise real systems. This also means highly interactive honeypots are difficult for attackers to detect and can gather more information. Highly interactive honeypots have the advantages of being difficult to identify and having stronger information-gathering capabilities.

[0008] This invention targets honeypots with a larger installation volume and lower interactivity.

[0009] Honeypots can be divided into two categories according to their purpose:

[0010] 1. Honeypots for production environments: These honeypots focus on protecting the real production environment, so it is essential to ensure that attackers cannot penetrate the production environment through the honeypot. Low to medium interaction honeypots are commonly used. Their main purpose is to delay or defend against attacks.

[0011] 2. Honeypots for research purposes: These honeypots focus on collecting information about attackers, are better at tracking and recording attack behavior, can discover new attack methods, or study defensive measures against attacks based on the information they have obtained.

[0012] Research-oriented honeypots are ubiquitous across the internet, collecting information about those they interact with. Identifying these honeypots, which fail to protect online privacy, is a crucial technology.

[0013] Honeypots can be further categorized based on their use cases, such as IoT honeypots and ICS honeypots. As attacks have occurred, these types of honeypots have received more widespread attention.

[0014] Commonly used open-source honeypots on the internet primarily mimic specific protocols. For example, Cowrie can simulate SSH and Telnet protocols and is also known as an SSH honeypot and a Telnet honeypot. Besides these, there are also HTTP honeypots, struct honeypots, and other open-source honeypots that simulate specific protocols.

[0015] II. Honeypot Derivative System

[0016] Based on the concept of honeypots, many variations have gradually emerged.

[0017] 1. Honeynet: A network consisting of multiple honeypots. A honeynet can disguise itself as a production environment, primarily for research and learning purposes. Therefore, highly interactive honeypots are often used to better deceive attackers. However, because honeynets are usually almost identical to the production environment, attackers can also learn the functional structure, tools used, and other information of the production system.

[0018] 2. Honeypot: A honeypot is a special form of honeynet. To prevent attackers from harming the entire system and other systems through compromised honeypots, virtual honeypots are introduced on top of the honeynet. Attackers interact with the virtual honeypots, which then reflect the attack behavior back to the real honeypots. The virtual honeypots, positioned in the middle, provide excellent security isolation.

[0019] 3. Honey Tags: Honey tags are a type of file that can be monitored to determine if content has been leaked or tampered with. Honey tags generally have the following characteristics: they are indistinguishable from ordinary files; they are placed in the most easily detectable locations; they are attractive to attackers; and modifications and access to them are monitored.

[0020] 4. Honeywall: A honeywall is the boundary between a honeynet and the production system. Its function is similar to a gateway, firewall, or NIDS, which securely isolates the two.

[0021] III. Research on Honeypot Detection Technology

[0022] 1. Mainstream tools for detecting honeypots:

[0023] HoneyHunter can detect proxy honeypots. Shodan Honey Score can detect whether an IP address is a honeypot by inputting its IP address. Other commonly used tools such as Metasploit and Nmap also have modules for detecting honeypots.

[0024] 2. Methods for detecting honeypots

[0025] There are multiple ways to identify honeypots, such as:

[0026] I. Detecting honeypots running on VMware:

[0027] Attackers can detect instances running on VMware virtual machines by analyzing MAC addresses.

[0028] II. Detecting the presence of Honeyd:

[0029] Honeyd is a honeypot simulation engine that can easily create thousands of honeypots. Honeyd responds to received SMTP requests with fake responses. Attackers can identify the existence of honeypots by performing time-based TCP fingerprinting.

[0030] III. Detecting the existence of a user-mode Linux (UML) honeypot:

[0031] Attackers can identify the existence of UML honeypots by analyzing files such as / proc / mounts, / proc / interrupt, and / proc / cmdline, which contain UML-specific information.

[0032] IV. Detecting the existence of Sebek-based honeypots:

[0033] Attackers can detect the presence of Sebek-based honeypots by analyzing network layer congestion, as Sebek data communication is typically unencrypted. Sebek logs all content accessed via reading() calls before it is transmitted to the network, thus contributing to congestion.

[0034] V. Detect the existence of Snort_inline Honeypot:

[0035] Attackers can identify these honeypots by analyzing outgoing data packets. If outgoing packets are lost, attackers might perceive it as a black hole. When snort_inline modifies outgoing packets, attackers can capture and identify the modified packets on another host system.

[0036] VI. Detecting the presence of fake access points:

[0037] The fake access point only sends beacon frames but does not generate any traffic on the access point itself. Attackers can detect and monitor network traffic and quickly notice the existence of the fake AP.

[0038] In general, the most common way to detect honeypots is through fingerprints, which can be summarized in four aspects:

[0039] (1) Hardware: such as the devices and drivers it uses

[0040] (2) Operating environment: memory and system conditions

[0041] (3) Applications in the system: installation and execution

[0042] (4) Behavior

[0043] The above four aspects summarize all the characteristics of the system. Even if a honeypot system is a one-to-one copy of a real system, it will still differ from the real system in these four aspects. Even if it is a one-to-one copy of the real system, its behavior will be inconsistent with the real system due to its recording and tracking actions. These inconsistencies are called the fingerprint of the honeypot. Through fingerprint characteristics, we can identify honeypots disguised as real systems.

[0044] The development of honeypot identification technology is crucial for cybersecurity. Advances in honeypot identification technology can promote the development of honeypots, improve their realism, and make them more difficult for attackers to identify. Improved honeypot identification technology can reduce false positives about normal network traffic. Accurate honeypot identification helps ensure that cybersecurity teams focus on genuine security threats, avoiding unnecessary alerts and interference. The development of honeypot identification technology also makes honeypot systems more resilient.

[0045] IV. SSH and Telnet protocols

[0046] SSH (Secure Shell) is a protocol used for secure remote login over a network. It provides encryption to protect network communications, preventing sensitive information from being stolen or tampered with during transmission. The SSH protocol is widely used for managing remote servers, executing commands, and transferring files.

[0047] Telnet is also a protocol used for remotely logging into computers and network devices. It's an application-layer protocol running on the TCP / IP protocol stack, originally designed to establish text terminal connections between computers. Telnet allows users to execute commands on remote hosts, view the status of remote systems, and perform basic file operations over a network. Summary of the Invention

[0048] To address the shortcomings of existing technologies, the purpose of this invention is to provide a method and system for batch mining and identifying honeypot fingerprints.

[0049] The method for batch mining and identifying honeypot fingerprints provided by the present invention includes:

[0050] Step S1: Construct a large number of different requests according to the protocol implemented by the honeypot;

[0051] Step S2: Set up instances and send requests to these instances, and record the responses;

[0052] Step S3: For a request, the responses obtained from different instances are called a set of responses, and the extended cosine value is calculated for each set of responses;

[0053] Step S4: Based on the extended cosine value, filter out the groups with the greatest differences and form fingerprints together with the corresponding requests;

[0054] Step S5: Use fingerprint detection to determine the likelihood that an unknown instance is a honeypot.

[0055] Preferably, step S1 includes: using network tools to understand the working principle and packet sending order of the protocol simulated by the honeypot, and combining a series of parameters with the official documentation to generate different requests in batches.

[0056] Preferably, step S2 includes: simultaneously setting up real instances and honeypot instances, as well as their different versions, sending the batch requests generated in the previous step to these multiple instances using Python sockets, recording the responses in a file, and merging multiple consecutive responses into a single response record in the file.

[0057] Preferably, step S3 includes: calculating the cosine value between the two responses, specifically:

[0058] Count the characters in the reply "1" and their frequency to obtain the first array;

[0059] Count the frequency of characters from reply 1 in reply 2 to obtain the second array. Count the frequency of other characters in reply 2 and add them to the end of the second array to form array B.

[0060] Add 0 elements to the end of the first array, expand the first array until it reaches the same dimension as array B, and finally get array A;

[0061] Convert arrays A and B into two vectors of the same dimension, and calculate their cosine values ​​using the following formula:

[0062]

[0063] The cosine values ​​between each pair of responses are calculated in this way, forming a matrix, as shown in the following formula:

[0064]

[0065] Where, {R1,...,R n} represents a set of replies, Cos(R) m R n ) represents the reply R m and reply R n The cosine value, 1≤m, n≤n;

[0066] The matrix obtained above is called C. Singular value decomposition is then performed on C:

[0067] C = USV T

[0068] Where C is an m-order matrix, U and V are both m-order orthogonal matrices, and S is an m-order diagonal matrix formed by arranging the singular values ​​of C in descending order of their diagonal elements. The singular values ​​of C are calculated by... T The eigenvalues ​​of C are obtained by taking their square roots.

[0069] Preferably, step S4 includes: confirming the threshold for the extended cosine value used to filter responses; first, selecting a threshold based on historical experience; then, building an experimental platform to obtain the recognition rate of this threshold; and measuring it through accuracy, false positive rate, and false negative rate, calculated using the following formula:

[0070]

[0071]

[0072]

[0073] The threshold is then adjusted up and down to find the threshold with the best effect as the screening criterion, and the filtered responses are obtained. A set of responses and their corresponding requests constitute a set of fingerprints.

[0074] The system for batch mining and identifying honeypot fingerprints according to the present invention includes:

[0075] Module M1: Constructs a large number of different requests based on the protocol implemented by the honeypot;

[0076] Module M2: Builds instances and sends requests to these instances, and records the responses;

[0077] Module M3: For a single request, the responses obtained from different instances are referred to as a set of responses, and the extended cosine value is calculated for each set of responses;

[0078] Module M4: Based on the extended cosine value, filter the groups with the greatest differences and form fingerprints together with the corresponding requests;

[0079] Module M5: Uses fingerprint detection to determine the likelihood that an unknown instance is a honeypot.

[0080] Preferably, the module M1 includes: using network tools to understand the working principle and packet sending order of the protocol simulated by the honeypot, and combining a series of parameters with the official documentation to generate different requests in batches.

[0081] Preferably, module M2 includes: simultaneously building real instances and honeypot instances, as well as their different versions; sending the batch requests generated in the previous step to these multiple instances using Python sockets; recording the responses in a file; and merging multiple consecutive responses into a single response record in the file.

[0082] Preferably, module M3 includes: calculating the cosine value between the two responses, specifically:

[0083] Count the characters in the reply "1" and their frequency to obtain the first array;

[0084] Count the frequency of characters from reply 1 in reply 2 to obtain the second array. Count the frequency of other characters in reply 2 and add them to the end of the second array to form array B.

[0085] Add 0 elements to the end of the first array, expand the first array until it reaches the same dimension as array B, and finally get array A;

[0086] Convert arrays A and B into two vectors of the same dimension, and calculate their cosine values ​​using the following formula:

[0087]

[0088] The cosine values ​​between each pair of responses are calculated in this way, forming a matrix, as shown in the following formula:

[0089]

[0090] Where, {R1,...,R n} represents a set of replies, Cos(R) m R n ) represents the reply R m and reply R n The cosine value, 1≤m, n≤n;

[0091] The matrix obtained above is called C. Singular value decomposition is then performed on C:

[0092] C = USVT

[0093] Where C is an m-order matrix, U and V are both m-order orthogonal matrices, and S is an m-order diagonal matrix formed by arranging the singular values ​​of C in descending order of their diagonal elements. The singular values ​​of C are calculated by... T The eigenvalues ​​of C are obtained by taking their square roots.

[0094] Preferably, module M4 includes: determining the threshold for the extended cosine value used to filter responses; firstly, selecting a threshold based on historical experience; then, building an experimental platform to obtain the recognition rate of this threshold; and measuring it through accuracy, false positive rate, and false negative rate, calculated using the following formula:

[0095]

[0096]

[0097]

[0098] The threshold is then adjusted up and down to find the threshold with the best effect as the screening criterion, and the filtered responses are obtained. A set of responses and their corresponding requests constitute a set of fingerprints.

[0099] Compared with the prior art, the present invention has the following beneficial effects:

[0100] (1) This invention provides a batch mining and identification method for honeypot fingerprints based on request construction and response filtering. Due to the introduction of extended cosine algorithm, it is more suitable than traditional cosine calculation for measuring the degree of difference between a group of two or more responses.

[0101] (2) In the step of forming fingerprints by screening responses, an experimental step has been added to select the threshold for screening responses, which can make the recognition more scientific and achieve better results.

[0102] (3) The present invention can quickly extract a large number of fingerprints without deep interaction with the instance, and has the characteristics of high efficiency and practicality. Attached Figure Description

[0103] Other features, objects, and advantages of the present invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0104] Figure 1 This is a flowchart illustrating the method for batch mining and identifying honeypot fingerprints according to the present invention;

[0105] Figure 2 This is a schematic diagram of the extended cosine algorithm in an embodiment of the present invention. Detailed Implementation

[0106] The present invention will now be described in detail with reference to specific embodiments. These embodiments will help those skilled in the art to further understand the present invention, but do not limit the invention in any way. It should be noted that those skilled in the art can make several changes and improvements without departing from the concept of the present invention. These all fall within the protection scope of the present invention.

[0107] Example 1

[0108] This invention provides a method for batch mining and identifying honeypot fingerprints based on request construction and response filtering. For honeypot construction requests implementing a specific protocol, responses are filtered to ultimately form fingerprints for honeypot identification. The specific steps are as follows:

[0109] Step S1: Construct a large number of different requests according to the protocol implemented by the honeypot;

[0110] Step S2: Build instances and send requests to these instances, and record the responses;

[0111] Step S3: For a request, the responses obtained from different instances are called a group of responses, and the extended cosine value is calculated for each group of responses;

[0112] Step S4: Based on the extended cosine value, filter out the groups with the greatest differences and form fingerprints together with the corresponding requests;

[0113] Step S5: Use fingerprint detection to identify unknown instances and determine their likelihood of being honeypots.

[0114] The platform implemented in this embodiment uses Windows 11 and Debian 12 operating systems and is implemented using Python 3.11. The case described in this embodiment is the fingerprint mining and identification of open-source honeypots. Specifically, the user of this service is a security researcher who needs to protect their privacy data, and the provided content is the fingerprint mining and identification of open-source honeypots. The purpose of this service is to extract fingerprints in batches from open-source honeypots for the purpose of identifying the honeypots.

[0115] Figure 1 This is a flowchart illustrating the method for batch mining and identifying honeypot fingerprints according to the present invention, specifically as follows:

[0116] Step S1: Construct a large number of different requests based on the protocol implemented by the honeypot. First, use network tools to understand the working principle and packet sending order of the protocol simulated by the honeypot, and combine a series of parameters with the official documentation to generate different requests in batches.

[0117] Step S2 involves simultaneously setting up real-world instances and honeypot instances, along with their different versions. Using Python sockets, send the batch requests generated in the previous step to these multiple instances and record the responses. Depending on the protocol characteristics, sometimes two consecutive requests may be needed to obtain responses that can vary depending on the implementation. These responses are recorded in detail in a file. Multiple consecutive responses are merged into a single response record in the file.

[0118] Step S3: For a single request, the responses received from different instances are considered a set of responses. The expanded cosine value of this set is calculated. The calculation process is as follows: Figure 2 As shown. First, calculate the cosine value between the two responses. Since the responses have different lengths, and calculating the cosine value requires two matrices of the same length, the two responses need to be processed during the calculation: 1) Count the characters in response 1 and their frequencies to obtain array 1; 2) Copy array 1', which has the same dimension as array 1 and is filled with all zeros. Following the character counting order in step 1, count the frequency of the characters in response 1 in response 2 to obtain array 2. Count the frequencies of other characters in response 2 and add them to the end of array 2 to form array B; 3) Add zero elements to the end of array 1 to expand array 1 until it reaches the same dimension as array B, finally obtaining array A; 4) Convert array A and array B into two vectors of the same dimension, and calculate their cosine values ​​according to the following formula:

[0119]

[0120] This method calculates the cosine values ​​between each pair of responses. These cosine values ​​form a matrix, as shown in the following equation:

[0121]

[0122] Where {R1,...,R n} represents a set of replies, Cos(R) m R n ) represents the reply R m and reply R n The cosine value of , where 1≤m,n≤n.

[0123] The matrix obtained above is called C. Singular value decomposition is then performed on C:

[0124] C = USV T

[0125] C is an m-order matrix, where U and V are both m-order orthogonal matrices. S is an m-order diagonal matrix formed by arranging the singular values ​​of C in descending order of their diagonal elements. The singular values ​​of C are calculated by... T The eigenvalues ​​of C are obtained by taking their square roots.

[0126] It can be further decomposed as follows:

[0127]

[0128] When K<m, a "rank-K approximation" C of C can be obtained K :

[0129]

[0130] When K=1, we can complete the simplification of the C matrix.

[0131] Step S4: Determine the threshold of the extended cosine value for screening replies. First, select an intuitively appropriate threshold, for example, 20%. Build an experimental platform (including multiple real instances and honeypot instances) to obtain the recognition rate of this threshold, which is measured by accuracy, false positive rate and false negative rate. The calculation formula is as follows:

[0132]

[0133]

[0134]

[0135] Then adjust the threshold up and down to find the threshold with the best effect as the screening criterion, and obtain the screened replies. A set of replies and their corresponding requests form a set of fingerprints.

[0136] Step S5: A set of fingerprints includes one request and a corresponding set of replies. These replies come from different instances and there are differences among them, and the screened replies are the ones with the largest differences among all groups. Send this request to an unknown instance, and determine which reply in the fingerprint set the received reply is closer to by calculating the cosine value, thereby determining whether the instance is a honeypot instance.

[0137] Because the extended cosine algorithm is introduced in the present invention, it is more suitable for measuring the degree of difference between a group of more than two replies than the traditional cosine calculation. In this embodiment, the collection of replies for the same instance is performed in multiple steps, which effectively avoids the common problem of restarting from the beginning caused by connection interruption (for a large number of requests, there are concurrency limits and connection quantity limits). In the step of screening replies to form fingerprints, an experimental link is added to select the threshold for screening replies, which can more scientifically enable the recognition to achieve better effects.

[0138] Embodiment 2

[0139] The present invention also provides a system for batch mining and identifying honeypot fingerprints. The system can be implemented by executing the process steps of the method for batch mining and identifying honeypot fingerprints. That is, those skilled in the art can understand the method for batch mining and identifying honeypot fingerprints as a preferred embodiment of the system.

[0140] The batch mining and identification system for honeypot fingerprints provided by the present invention includes: module M1: constructing a large number of different requests according to the protocol implemented by the honeypot; module M2: building instances and sending requests to these instances, and recording the responses; module M3: for a request, referring to the responses obtained by different instances as a group of responses, and calculating the extended cosine value for each group of responses; module M4: based on the extended cosine value, filtering the groups with the greatest differences, and forming a fingerprint together with the corresponding request; module M5: using the fingerprint to detect unknown instances and obtain the probability that they are honeypots.

[0141] The module M1 includes: using network tools to understand the working principle and packet sending order of the protocol simulated by the honeypot, and combining a series of parameters with the official documentation to generate different requests in batches.

[0142] The module M2 includes: simultaneously building real instances and honeypot instances, as well as their different versions; sending the batch requests generated in the previous step to these multiple instances using Python sockets; recording the responses in a file; and merging multiple consecutive responses into a single response record in the file.

[0143] The module M3 includes: calculating the cosine value between the two responses, specifically:

[0144] Count the characters in the reply "1" and their frequency to obtain the first array;

[0145] Count the frequency of characters from reply 1 in reply 2 to obtain the second array. Count the frequency of other characters in reply 2 and add them to the end of the second array to form array B.

[0146] Add 0 elements to the end of the first array, expand the first array until it reaches the same dimension as array B, and finally get array A;

[0147] Convert arrays A and B into two vectors of the same dimension, and calculate their cosine values ​​using the following formula:

[0148]

[0149] The cosine values ​​between each pair of responses are calculated in this way, forming a matrix, as shown in the following formula:

[0150]

[0151] Where, {R1,...,R n} represents a set of replies, Cos(R) m R n ) represents the reply R m and reply R n The cosine value, 1≤m, n≤n;

[0152] The matrix obtained above is called C. Singular value decomposition is then performed on C:

[0153] C = USV T

[0154] Where C is an m-order matrix, U and V are both m-order orthogonal matrices, and S is an m-order diagonal matrix formed by arranging the singular values ​​of C in descending order of their diagonal elements. The singular values ​​of C are calculated by... T The eigenvalues ​​of C are obtained by taking their square roots.

[0155] The module M4 includes: determining the threshold for the extended cosine value used to filter responses; firstly, selecting a threshold based on historical experience; then building an experimental platform to obtain the recognition rate of this threshold; and measuring it through accuracy, false positive rate, and false negative rate, calculated using the following formula:

[0156]

[0157]

[0158]

[0159] The threshold is then adjusted up and down to find the threshold with the best effect as the screening criterion, and the filtered responses are obtained. A set of responses and their corresponding requests constitute a set of fingerprints.

[0160] Those skilled in the art will understand that, in addition to implementing the system, apparatus, and their modules provided by this invention in purely computer-readable program code, the same program can be implemented in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, the system, apparatus, and their modules provided by this invention can be considered a hardware component, and the modules included therein for implementing various programs can also be considered structures within the hardware component; alternatively, modules for implementing various functions can be considered both software programs implementing the method and structures within the hardware component.

[0161] Specific embodiments of the present invention have been described above. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art can make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. Unless otherwise specified, the embodiments and features described in this application can be arbitrarily combined with each other.

Claims

1. A method for batch mining and identifying honeypot fingerprints, characterized in that, include: Step S1: Construct a large number of different requests according to the protocol implemented by the honeypot; Step S2: Set up instances and send requests to these instances, and record the responses; Step S3: For a request, the responses obtained from different instances are called a set of responses, and the extended cosine value is calculated for each set of responses; Step S4: Based on the extended cosine value, filter out the groups with the greatest differences and form fingerprints together with the corresponding requests; Step S5: Use fingerprint detection to identify unknown instances and determine their likelihood of being honeypots; Step S3 includes: calculating the cosine value between the two responses, specifically: Count the characters in the reply "1" and their frequency to obtain the first array; Count the frequency of characters from reply 1 in reply 2 to obtain the second array. Count the frequency of other characters in reply 2 and add them to the end of the second array to form array B. Add 0 elements to the end of the first array, expand the first array until it reaches the same dimension as array B, and finally get array A; Convert arrays A and B into two vectors of the same dimension, and calculate their cosine values ​​using the following formula: The cosine values ​​between each pair of responses are calculated in this way, forming a matrix, as shown in the following formula: in,{ ... } represents a set of replies, Cos( , () represents a reply and reply The cosine value, 1 m n n; The matrix obtained above is called C. Singular value decomposition is then performed on C: Where C is an m-order matrix, U and V are both m-order orthogonal matrices, and S is an m-order diagonal matrix formed by arranging the singular values ​​of C in descending order of their diagonal elements. The singular values ​​of C are calculated... The eigenvalues ​​are obtained by taking their square roots.

2. The method for batch mining and identifying honeypot fingerprints according to claim 1, characterized in that, Step S1 includes: using network tools to understand the working principle and packet sending order of the protocol simulated by the honeypot, and combining a series of parameters with the official documentation to generate different requests in batches.

3. The method for batch mining and identifying honeypot fingerprints according to claim 1, characterized in that, Step S2 includes: simultaneously setting up real instances and honeypot instances, as well as their different versions; sending the batch requests generated in the previous step to these multiple instances using Python sockets; recording the responses in a file; and merging multiple consecutive responses into a single response record in the file.

4. The method for batch mining and identifying honeypot fingerprints according to claim 1, characterized in that, Step S4 includes: confirming the threshold for the extended cosine value used to filter responses. First, a threshold is selected based on historical experience. Then, an experimental platform is built to obtain the recognition rate of this threshold. The accuracy rate, false positive rate, and false negative rate are used to measure the accuracy rate. The calculation formula is as follows: The threshold is then adjusted up and down to find the threshold with the best effect as the screening criterion, and the filtered responses are obtained. A set of responses and their corresponding requests constitute a set of fingerprints.

5. A system for batch mining and identifying fingerprints of honeypots, characterized in that, include: Module M1: Constructs a large number of different requests based on the protocol implemented by the honeypot; Module M2: Builds instances and sends requests to these instances, and records the responses; Module M3: For a single request, the responses obtained from different instances are referred to as a set of responses, and the extended cosine value is calculated for each set of responses; Module M4: Based on the extended cosine value, filter the groups with the greatest differences and form fingerprints together with the corresponding requests; Module M5: Uses fingerprint detection to determine the likelihood of an unknown instance being a honeypot; The module M3 includes: calculating the cosine value between the two responses, specifically: Count the characters in the reply "1" and their frequency to obtain the first array; Count the frequency of characters from reply 1 in reply 2 to obtain the second array. Count the frequency of other characters in reply 2 and add them to the end of the second array to form array B. Add 0 elements to the end of the first array, expand the first array until it reaches the same dimension as array B, and finally get array A; Convert arrays A and B into two vectors of the same dimension, and calculate their cosine values ​​using the following formula: The cosine values ​​between each pair of responses are calculated in this way, forming a matrix, as shown in the following formula: in,{ ... } represents a set of replies, Cos( , () represents a reply and reply The cosine value, 1 m n n; The matrix obtained above is called C. Singular value decomposition is then performed on C: Where C is an m-order matrix, U and V are both m-order orthogonal matrices, and S is an m-order diagonal matrix formed by arranging the singular values ​​of C in descending order of their diagonal elements. The singular values ​​of C are calculated... The eigenvalues ​​are obtained by taking their square roots.

6. The system for batch mining and identifying fingerprints of honeypots according to claim 5, characterized in that, The module M1 includes: using network tools to understand the working principle and packet sending order of the protocol simulated by the honeypot, and combining a series of parameters with the official documentation to generate different requests in batches.

7. The system for batch mining and identifying honeypot fingerprints according to claim 5, characterized in that, The module M2 includes: simultaneously building real instances and honeypot instances, as well as their different versions; sending the batch requests generated in the previous step to these multiple instances using Python sockets; recording the responses in a file; and merging multiple consecutive responses into a single response record in the file.

8. The system for batch mining and identifying fingerprints of honeypots according to claim 5, characterized in that, The module M4 includes: determining the threshold for the extended cosine value used to filter responses; firstly, selecting a threshold based on historical experience; then building an experimental platform to obtain the recognition rate of this threshold; and measuring it through accuracy, false positive rate, and false negative rate, calculated using the following formula: The threshold is then adjusted up and down to find the threshold with the best effect as the screening criterion, and the filtered responses are obtained. A set of responses and their corresponding requests constitute a set of fingerprints.

Images