Network attack resistance system based on virtual honeypot

Abstract

The application discloses a network attack resisting system based on a virtual honeypot, and relates to the technical field of network attack defense; the application comprises a lightweight probe arranged in a target system and a virtual honeypot module used for constructing and updating a virtual environment; the application collects static system features and dynamic behavior features of the target system through the lightweight probe; the virtual environment consistent with the static performance of the target system is constructed based on the static features; the dynamic adjustment is performed on the virtual environment in combination with the dynamic features; the feature data is regularly updated by the probe; the virtual honeypot unit can be dynamically adapted with the change of the target system; the application effectively solves the easily-recognized problem caused by the invariable static features or reset features of the traditional virtual honeypot, significantly improves the fidelity of the honeypot, reduces the probability of being recognized by an attacker, and enhances the ability of trapping attacks.

Description

Technical Field

[0001] This invention belongs to the field of network attack defense and relates to virtual honeypot technology, specifically a network attack defense system based on virtual honeypots. Background Technology

[0002] Virtual honeypot technology, as an important means of network attack defense, constructs a deceptive environment by simulating the characteristics of a real system to attract attackers, thereby achieving attack monitoring and defense. In existing technologies, the construction of virtual honeypots mostly relies on the one-time collection of static characteristics of the target system, such as operating system version, open ports, file structure, etc., to generate a fixed virtual environment based on these static characteristics, and maintain the deception capability by periodically resetting it.

[0003] However, real systems are not static; their hardware configurations, software versions, and data assets change dynamically over time. In existing technologies, virtual honeypots retain the initially collected static characteristics upon reset, resulting in long-term fixed virtual environment characteristics that differ significantly from the dynamic changes of real systems. Attackers can identify virtual honeypots by detecting these differences, thereby evading their attacks. This significantly reduces the effectiveness of virtual honeypots in trapping attackers and makes them less effective at defending against cyberattacks.

[0004] This invention provides a network attack defense system based on virtual honeypots to solve the above-mentioned technical problems. Summary of the Invention

[0005] This invention aims to solve at least one of the technical problems existing in the prior art. To this end, this invention proposes a network attack defense system based on virtual honeypots. This system collects the static system characteristics and dynamic behavioral characteristics of the target system through lightweight probes. First, it constructs a virtual environment consistent with the static behavior of the target system based on the static characteristics. Then, it dynamically adjusts the virtual environment by combining the dynamic characteristics. The probes periodically update the characteristic data, so that the virtual honeypot unit can dynamically adapt to changes in the target system. This effectively solves the problem of easy identification caused by static or reset characteristics of traditional virtual honeypots, significantly improves the realism of the honeypot, reduces the probability of being identified by attackers, and enhances the ability to lure attacks.

[0006] To achieve the above objectives, a first aspect of the present invention provides a network attack defense system based on a virtual honeypot, comprising: Lightweight probe: Used to collect basic system characteristics of the target system; where the target system is the real system to be simulated, and the basic system characteristics include static system characteristics and dynamic behavior characteristics; Virtual honeypot module: used to extract static system features from basic system features; to simulate and construct a virtual environment based on these static system features; and, It is used to extract dynamic behavior features from the characteristics of the basic system; based on the dynamic behavior features, the virtual environment is dynamically adjusted to obtain the virtual honeypot unit.

[0007] Preferably, simulations are based on static system characteristics, including: Analyze the characteristics of the static system and extract static system data from these characteristics; A virtual environment is constructed using static system data; the virtual environment exhibits the same static behavior as the target system.

[0008] Preferably, dynamically adjusting the virtual environment based on dynamic behavioral characteristics includes: Extracting dynamic behavior data from dynamic behavior features; The time parameters in the dynamic behavior data are differentiated and adjusted to obtain the target adjustment parameters; the virtual environment is dynamically adjusted based on the target adjustment parameters to obtain the virtual honeypot unit.

[0009] Preferably, the files created by the attacker in the virtual honeypot unit include: Real-time detection of changed files in virtual honeypot units; changed files include newly created or modified files; Determine whether the file modification process conforms to the file modification process of the virtual environment; if yes, it is determined that the file was created by the virtual environment; otherwise, it is determined that the file was created by the attacker and marked as the target file.

[0010] Preferably, the method of handling the target file is matched according to the security protection rules in the dynamic behavior characteristics, including: Extracting security protection rules from dynamic behavioral characteristics; The handling method for the target file is matched based on security protection rules; the handling method includes deleting the target file or retaining the target file.

[0011] Preferably, before resetting the virtual honeypot unit, the data assets that need to be saved in the virtual honeypot unit are detected; the data assets that need to be saved are isolated and stored. When a virtual honeypot unit is reset, data is selected from the retained data assets and replanted into the reset virtual environment to obtain the reset virtual honeypot unit.

[0012] Preferably, the data assets that need to be retained in the detection virtual honeypot unit include: Detect disguised data and attack log data in the virtual honeypot unit; the disguised data is used to prevent attackers from noticing that the virtual honeypot unit has been reset, and the disguised data includes target files; Disguised data and attack log data are packaged separately and then integrated as data assets that need to be retained.

[0013] Preferably, selecting data from preserved data assets and reimplanting it into the reset virtual environment includes: Extract disguised data from retained data assets and verify the replantability of the disguised data based on security protection rules; The verified spoofed data is then re-implanted into the reset virtual environment.

[0014] Preferably, the replantability verification of disguised data is performed based on security protection rules, including: Before reimplance, extract the latest security protection rules; based on these security protection rules, match the handling method for the target data in the disguised data; The decision on whether to reinstall the target file in the reset virtual environment will be based on the matching handling method.

[0015] Preferably, the decision on whether to re-implant the corresponding data into the reset virtual environment is based on the matching processing method, including: If the matching disposal method is to keep the file, then the target file will be replanted; If the matching handling method is file deletion, the decision on whether to replant the target file is based on the execution time of the deletion command.

[0016] Compared with the prior art, the beneficial effects of the present invention are: 1. This invention collects static system features and dynamic behavioral features of the target system using a lightweight probe. First, a virtual environment consistent with the static behavior of the target system is constructed based on the static features. Then, the virtual environment is dynamically adjusted in conjunction with the dynamic features. The probe updates the feature data periodically, enabling the virtual honeypot unit to dynamically adapt to changes in the target system. This invention effectively solves the problem of easy identification caused by static or reset features in traditional virtual honeypots, significantly improves the realism of the honeypot, reduces the probability of being identified by attackers, and enhances the ability to lure attacks.

[0017] 2. This invention detects changed files in the virtual honeypot unit in real time, identifies target files created by attackers based on the file change process in the virtual environment, and matches the handling method of the target files based on the security protection rules of the target system. This invention ensures that the processing logic for files created by attackers is consistent with the real system, avoids the risk of being identified by attackers due to abnormal file processing methods, improves the camouflage persistence of the honeypot, and ensures the effective capture and recording of attack behavior.

[0018] 3. Before resetting the virtual honeypot unit, this invention detects and retains disguised data and attack record data. During the reset, only disguised data that has been verified by the latest security protection rules is replanted. This invention avoids the disruption of environmental continuity caused by the reset from being detected by attackers, maintains the disguise authenticity of the honeypot through selective replanting, and retains valuable attack data for analysis, thus balancing the honeypot's trapping ability and data value after the reset. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a schematic diagram of the network attack defense system in Embodiment 1 of the present invention. Figure 2 This is a schematic diagram of the target file recognition and processing flow in Embodiment 2 of the present invention; Figure 3 This is a schematic diagram of the data asset re-implantation process in Embodiment 3 of the present invention. Detailed Implementation

[0021] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] Please see Figure 1 The first aspect of this invention provides a network attack defense system based on a virtual honeypot, comprising: Lightweight probe: Used to collect basic system characteristics of the target system; where the target system is the real system to be simulated, and the basic system characteristics include static system characteristics and dynamic behavior characteristics; Virtual honeypot module: used to extract static system features from basic system features; to simulate and construct a virtual environment based on these static system features; and, It is used to extract dynamic behavior features from the characteristics of the basic system; based on the dynamic behavior features, the virtual environment is dynamically adjusted to obtain the virtual honeypot unit.

[0023] Virtual honeypot technology is a security technique that uses deceptive network resources (such as hosts, services, and data) to attract attackers and enable the monitoring, analysis, and defense against such attacks. Its core objective is to reduce the threat to the real system by attracting attackers, while simultaneously gathering attack intelligence to improve overall security capabilities.

[0024] Virtual honeypots deliberately disguise themselves as real systems, but they are essentially traps, and deviations still exist in system behavior, interaction depth, and environmental characteristics. Attackers can identify virtual honeypots by looking for differences between them and the real systems they simulate. If attackers accurately identify virtual honeypots, they will find it difficult to attract attacks and improve the real system's ability to resist cyberattacks.

[0025] Compared to real systems, virtual honeypots have the following main problems: 1) In terms of system behavior, files in a real system change over time, such as log updates, temporary file generation, and user data modification. However, files in a virtual honeypot are relatively static. Virtual honeypots may experience abnormal file states due to frequent resets. For example, random files created by attackers may disappear or be reset due to virtual honeypot resets. The modification time of critical files in a virtual honeypot may remain unchanged for a long time. Attackers can use these anomalies to identify virtual honeypots.

[0026] 2) In terms of interaction depth, virtual honeypots may be identified if attackers cannot get a valid response after entering a specific command due to incomplete simulation or lack of preset specific commands; or virtual honeypots may be identified by default as providing the highest privileges to attract attackers, and the virtual honeypot will not restrict attackers when they perform operations beyond their privileges.

[0027] If an attacker identifies a virtual honeypot through detection tools or other identification methods, the attacker may not reveal their true attack behavior and methods, making it difficult to set up targeted defense measures.

[0028] The virtual honeypot module is used to deploy virtual honeypot units that meet the set requirements based on idle IPs and / or ports in the network, and to monitor the access traffic of each virtual honeypot unit and record the attacking IP address and / or port.

[0029] The security policy module generates attack mitigation policies based on the attacking IP addresses and / or ports recorded by the virtual honeypot module, and distributes these policies to the firewall module. The firewall module then restricts data traffic based on the attack mitigation policies.

[0030] The virtual honeypot module acquires available IPs or ports on the network in real time and combines them with the target system (which is the real system to be simulated) to construct a virtual honeypot unit. For example, it detects unresponsive IPs within the network segment through ARP scanning or obtains unassigned IPs through DHCP log analysis, and detects unlistened ports of real devices as free ports.

[0031] The difference between building virtual honeypot units based on idle IPs and based on ports is as follows: Building based on idle IPs can simulate a complete system or network node, such as a server or an IoT device, suitable for simulating a network environment with multiple independent devices; building based on ports involves opening multiple different ports on a single idle IP to simulate different services, with each port corresponding to a virtual honeypot. Virtual honeypots simulated based on idle IPs are more realistic, but they also require more resources.

[0032] Lightweight probes are deployed in the target system to collect basic system characteristics of the target system; these basic system characteristics include static system characteristics and dynamic behavioral characteristics.

[0033] Static system characteristics mainly include basic system data, service application data, user permission data, business scenario data, and network interaction data. Basic system data primarily includes system identifiers, file systems, processes, and resources; these are the foundational data of the target system and form the basis for simulating it. Service application data mainly includes web service data, database service data, and software application data. User permission data refers to the permissions configured for different types of users in the target system. Business scenario data refers to the data generated by the target system in real business scenarios. Network interaction data includes protocol interaction data and traffic characteristic data.

[0034] Dynamic behavioral characteristics mainly include asset change patterns, communication interaction rules, and security protection rules. Asset change patterns refer to the changing patterns of various data in the target system, such as periodic updates and updates upon reaching preset conditions. Communication interaction rules mainly refer to the target system's external requests and responses to external scans, and security protection rules refer to the processing rules of the target system when abnormal data or behaviors are detected.

[0035] The data collected by lightweight probes from the target system forms the foundation for building virtual honeypots. Lightweight probes must ensure low resource consumption to avoid impacting the real system's operation; the collection method should be non-intrusive, not modifying the target system configuration, and only obtaining information by reading system interfaces / files to improve security; sensitive data should also be filtered, collecting only characteristic information to prevent the leakage of critical data.

[0036] Lightweight probes should ideally use compiled languages ​​(such as Go) or lightweight scripting languages ​​(such as Python with C extensions) to ensure low resource consumption. During deployment, they can run in the background as a Windows service on a physical machine or virtual machine, collecting data periodically. Lightweight probes should have (pre-defined) read permissions only, prohibiting write / modification operations.

[0037] After the lightweight probe collects data, it needs to filter sensitive information, such as replacing real IP addresses, user password hashes, and password file paths, and using generic names to replace real usernames in the file paths. After completing the sensitive information filtering, the data is encrypted and sent to the virtual honeypot module after standardization.

[0038] It is worth noting that, due to the different construction methods and requirements of virtual honeypot units, it is not necessary for the virtual environment corresponding to each virtual honeypot unit to simulate all the basic system characteristics of the target system. Only targeted simulation is required. For example, only static system characteristics can be simulated, or even only the basic system data or interactive services of the target system in the static system characteristics can be simulated.

[0039] In constructing virtual honeypot modules, existing solutions typically simulate the real environment of the target system based on static system characteristics. This simulated virtual environment is then periodically reset to maintain the honeypot's ability to trap attackers. However, this method of constructing a virtual honeypot relies on a single set of collected static system characteristics for resetting, meaning that the characteristics of the virtual environment remain largely unchanged regardless of how many times it is reset. Real systems, however, are not static; their hardware, software, and data assets change over time, creating vulnerabilities that attackers can exploit to identify the virtual honeypot.

[0040] In a preferred embodiment, the simulation is based on the characteristics of the underlying system, including: Extract static system features from the basic system features; simulate based on the static system features to construct a virtual environment; Dynamic behavioral features are extracted from the characteristics of the basic system; the virtual environment is dynamically adjusted based on the dynamic behavioral features to obtain the virtual honeypot unit.

[0041] To address the issues existing in virtual honeypot simulation resets, this embodiment uses a lightweight probe to periodically collect basic system characteristics of the target system. Based on the static system characteristic lines within these basic characteristics, a virtual environment is simulated. Then, dynamic behavioral characteristics are used to dynamically adjust the virtual environment, enabling the constructed virtual honeypot unit to be indistinguishable from a real one.

[0042] Because the lightweight probe is deployed within the real system it simulates, the basic system characteristics it collects are updated in a timely manner, allowing the virtual honeypot unit to be reset based on the latest basic system characteristics. Compared to existing solutions where the virtual honeypot uses data collected only once for multiple collections, this embodiment's method of resetting using the latest basic system characteristics is more reliable and has a higher success rate in luring attackers.

[0043] It's worth noting that a dynamically adjusted virtual environment can function as a virtual honeypot. Besides containing the virtual environment used to lure attackers, a virtual honeypot unit also includes various types of tools and necessary storage space, at least including analysis tools and intervention tools. Analysis tools are used to detect attacker behavior, while intervention tools are used to reset and adjust the virtual environment. All tools interact with the virtual honeypot module. The storage space is used for data storage and is not exposed to attackers, nor do attackers have access to it. Similarly, attackers are unaware of the various tools.

[0044] In a preferred embodiment, simulation based on static system characteristics includes: Analyze the characteristics of the static system and extract static system data from these characteristics; A virtual environment is constructed using static system data; the virtual environment exhibits the same static behavior as the target system.

[0045] In constructing a virtual honeypot unit, the static system characteristics are first analyzed, and similar simulated system characteristics are generated. These simulated system characteristics are then used to construct the virtual environment of the honeypot unit. After the virtual environment is built, the attacker's experience of accessing it is identical to that of accessing the real system. For example, applications present in the real system also exist in the virtual environment, as do data files from the real system. The difference lies in the fact that while the data assets obtained by the attacker in the virtual environment may appear legitimate, they are actually different from those in the target system, and the data obtained by the attacker from the virtual environment has no effective use.

[0046] Since the basic system data is processed data, it does not contain sensitive data from the target system. When building a virtual environment using static system data, the system architecture and basic interactions of the target system can be simulated, but sensitive data will not be included. Data filling is indeed required during construction, which can be done using non-sensitive data or fabricated data.

[0047] A virtual environment built based on static system data exhibits the same static characteristics as the target system, including system type, version number, hardware and software information, data directories, and related data files. This static consistency means that entering the virtual environment is indistinguishable from entering the target system, making it difficult to identify a virtual honeypot without detailed analysis.

[0048] If an attacker enters a virtual environment and dynamically compares it with a similar system to the target system, they are likely to identify the virtual honeypot due to inconsistencies in dynamic characteristics. Files in the virtual environment are relatively static, but the target system's data assets are constantly changing due to numerous real interactions. If a virtual honeypot unit is used to lure attackers based solely on static system characteristics, it is easily detected. As mentioned earlier, if an attacker can identify a virtual honeypot by detecting patterns in file changes when accessing the virtual honeypot unit, the virtual environment can be identified as a virtual honeypot.

[0049] In a preferred embodiment, dynamically adjusting the virtual environment based on dynamic behavioral characteristics includes: Extracting dynamic behavior data from dynamic behavior features; The time parameters in the dynamic behavior data are differentiated and adjusted to obtain the target adjustment parameters; the virtual environment is dynamically adjusted based on the target adjustment parameters to obtain the virtual honeypot unit.

[0050] As mentioned earlier, dynamic behavioral characteristics mainly include asset change patterns, communication interaction rules, and security protection rules. Asset change patterns refer to the patterns of change in data files within the target system under real-world interaction conditions; these patterns include file creation and file updates. Communication interaction rules refer to whether the target system actively interacts with external systems and generates interaction records. Security protection rules refer to the internal security protection strategies of the target system, which may be updated and executed periodically. Asset change patterns, communication interaction rules, and security protection rules all impact the data assets within the system.

[0051] To identify virtual honeypots by detecting the temporal state of the system, attackers need to analyze the dynamic behavioral characteristics of the target system and, after differential adjustments, obtain the behavioral change patterns to be simulated. Based on these behavioral change patterns, the virtual environment is dynamically adjusted to make it appear to have a large amount of interaction, making it difficult to identify the virtual honeypot by detecting file change patterns.

[0052] As an example, and not a limitation, considering asset change patterns, it can be identified that file A is updated periodically. By extracting its update cycle, the update cycle can be adjusted, even to the point of irregular updates. The adjusted update parameters can then be used as the target adjustment parameters for file A. Based on these fundamental parameters, file A can be modified and updated. Since file A is not static, it is difficult for attackers to identify a virtual honeypot based on file A.

[0053] Example 2: Based on Example 1, this example sets up defensive measures against attackers' active identification of virtual honeypot units, improving the camouflage of virtual honeypot units and reducing the probability of being identified by attackers.

[0054] In a virtual environment, the temporal state of files changes similarly to that of the target system, making it difficult for attackers to identify a virtual honeypot by simply detecting the file state. However, some attackers will actively create files and observe how the system processes them to determine if a file is a virtual honeypot.

[0055] Please see Figure 2 The overall approach is as follows: identify the files created by the attacker in the virtual honeypot unit and mark them as target files; then match the handling method for the target file according to the security protection rules in the dynamic behavior characteristics.

[0056] To prevent attackers from creating files in a virtual environment to identify virtual honeypots based on whether the files have been reset, it is necessary to detect the files created by attackers in a timely manner and treat them as target files; first, match the handling method of the target file with the security protection rules.

[0057] The pre-defined security rules in the virtual environment are extracted from the dynamic behavioral characteristics of the target system. If necessary, the execution time of the data processing for these security rules can be differentiated to distinguish them from those of the target system. If the target file exists in the target system, its security rule execution response will delete the target file, and the virtual honeypot should also delete it. If the target system does not delete the target file, the virtual honeypot will not delete it either.

[0058] By processing target files detected in the virtual environment based on the security protection rules of the target system, it can be ensured that the processing method of the target files is consistent with that of the target system. Whether they are kept or deleted, they will not leave any loopholes for attackers and prevent attackers from identifying the virtual honeypot.

[0059] Detection tools deployed within the virtual honeypot unit identify files that have changed independently outside the virtual environment and label them as files created by attackers. These attacker-created files are primarily used to verify the system's operational logic. For example, files in an existing virtual honeypot are relatively static; they are retained unless reset, but are deleted upon reset. Attackers can then determine whether the system is operating within a real system or a virtual honeypot based on the system's handling of these files.

[0060] In a preferred embodiment, identifying files created by an attacker within a virtual honeypot unit includes: Real-time detection of changed files in virtual honeypot units; changed files include newly created or modified files; Determine whether the file modification process conforms to the file modification process of the virtual environment; if yes, it is determined that the file was created by the virtual environment; otherwise, it is determined that the file was created by the attacker and marked as the target file.

[0061] When identifying files created by attackers in a virtual honeypot unit, the file change rules of the virtual honeypot unit are followed. That is, if a file is changed by the virtual honeypot unit during the simulation of the system's operation or interaction process, it cannot be identified as a file created by the attacker. Apart from files changed by the virtual honeypot unit itself, all other files can be considered as files created by the attacker.

[0062] The file modification process in a virtual environment refers to the process by which a virtual honeypot unit operates on files within the virtual environment based on its built-in rules. In other words, the file modification process is triggered by the built-in rules of the virtual honeypot unit; for example, built-in rules create file modification instructions, and these instructions cause file changes. An attacker's file creation process is not part of the file modification process in the virtual environment.

[0063] As an example, and not a limitation, file B was deployed in the virtual environment when constructing the virtual honeypot unit. Based on the dynamic behavior characteristics of the target system, the target adjustment parameter for file B was set to change the file every minute. If, during real-time detection, it is found that file B's last change did not occur within a minute, then file B can be considered a file created by the attacker.

[0064] When a target file is identified, neither retaining nor deleting it directly is appropriate. If the target file is not dangerous to the target system, it might be retained within the system. However, deleting it from the virtual honeypot unit could help attackers identify the unit. Similarly, if security rules in the target system identify the target file and execute a protection policy to delete it, retaining it within the virtual honeypot unit would also help attackers identify the unit.

[0065] In a preferred embodiment, the handling method for the target file is matched according to the security protection rules in the dynamic behavior characteristics, including: Extracting security protection rules from dynamic behavioral characteristics; The method of handling the target file is matched based on security protection rules; the method of handling includes deleting the file or keeping the file.

[0066] Dynamic behavioral features are extracted from the basic system characteristics collected by the lightweight probe. Security protection rules are then extracted from these dynamic behavioral features, ensuring that the security protection rules are the latest security protection rules for the target system. Next, the handling method of the target file is matched based on the security protection rules. If the handling method is to delete the file, the target file is deleted from the virtual honeypot unit; if the handling method is to retain the file, the target file is retained in the virtual honeypot unit.

[0067] Example 3: Based on Example 2, this example imposes constraints on the data re-implantation process during the virtual honeypot unit reset to ensure the camouflage of the virtual honeypot unit after reset and reduce the probability of the virtual honeypot unit being identified due to reset.

[0068] Virtual honeypots, acting as "masquerading systems" to lure attackers, require periodic or on-demand resets after being attacked or running for an extended period. Resetting serves two purposes: firstly, it removes traces of attacks. Attackers may leave malicious code, backdoors, or tamper with configurations within the virtual honeypot. Resetting restores the honeypot to its initial state, preventing attackers from continuously exploiting known vulnerabilities and ensuring continued effectiveness in luring subsequent attacks. Secondly, resetting maintains the authenticity of the disguise. Over time, virtual honeypots may exhibit environmental parameters that deviate from the real system, such as log buildup or abnormal resource consumption. Resetting restores the realism of the disguise, effectively preventing attackers from identifying it.

[0069] Please see Figure 3 The overall approach is as follows: Before resetting the virtual honeypot unit, detect the data assets that need to be saved in the virtual honeypot unit; isolate and store the data assets that need to be saved. When a virtual honeypot unit is reset, data is selected from the retained data assets and replanted into the reset virtual environment to obtain the reset virtual honeypot unit.

[0070] Virtual honeypot unit reset primarily involves resetting the constructed virtual environment to ensure it closely resembles the target environment. Before resetting, data related to attacker behavior, malicious samples, attacker identification clues, and operation logs need to be isolated and saved. Some of this data is used to analyze attackers and configure defense strategies, while the remaining data needs to be replanted into the reset virtual environment.

[0071] In a preferred embodiment, detecting data assets that need to be retained in the virtual honeypot unit includes: Detect disguised data and attack log data in the virtual honeypot unit; the disguised data is used to prevent attackers from noticing that the virtual honeypot unit has been reset, and the disguised data includes target files; Disguised data and attack log data are packaged separately and then integrated as data assets that need to be retained.

[0072] Disguised data, once replanted, can prevent attackers from noticing that the virtual honeypot unit has been reset. Disguised data includes files / directories previously accessed by the attacker, historical interaction traces, and sensitive information of interest to the attacker. Historical interaction traces include command-line history and log file access records, while sensitive information refers to data the attacker attempts to obtain.

[0073] Disguised data is crucial for the camouflage of a virtual honeypot unit. If all disguised data is deleted after a virtual honeypot unit is reset, attackers can easily identify the unit based on the data deletion. However, if the disguised data is re-implanted into the virtual environment after the honeypot unit is reset, attackers will find it difficult to detect the anomaly, thus reducing the probability of identifying the virtual honeypot unit.

[0074] Attack log data is used to analyze attacker behavior and thus locate the attacker. This data does not need to be re-implanted into the reset virtual environment.

[0075] In a preferred embodiment, selecting data from retained data assets and replanting it in the reset virtual environment includes: Extract disguised data from retained data assets and verify the replantability of the disguised data based on security protection rules; The verified spoofed data is then re-implanted into the reset virtual environment.

[0076] After resetting the virtual environment, it is also necessary to re-implant the disguised data from the previously retained data assets to ensure that the virtual environment after data re-implantation will not arouse the suspicion of attackers and reduce the possibility of being identified.

[0077] Before data is re-implanted into the virtual environment, it should be verified against security protection rules. This is because the target system's security protection rules are constantly updated, and the processing of some files is still done manually, which makes the security protection rules somewhat unpredictable. Before re-implanting the data, it should be verified against the latest security protection rules. If the latest security protection rules still determine that the corresponding type of data should be retained, then the corresponding type of data will be re-implanted into the reset virtual environment.

[0078] It should be noted that the disguised data includes various operation logs of the attacker and target files. All operation logs should be re-implanted into the reset virtual environment; however, operation logs that need to be deleted based on security protection rules will not be re-implanted. Target files are mainly files actively created by the attacker; whether they are re-implanted depends on the latest security protection rules.

[0079] In a preferred embodiment, the replantability verification of the spoofed data is performed based on security protection rules, including: Before reimplance, extract the latest security protection rules; based on these security protection rules, match the handling method for the target data in the disguised data; The decision on whether to re-implant the target data into the reset virtual environment will be based on the matching processing method.

[0080] The latest security protection rules refer to the most recently updated security protection rules for the target system, including protection policies generated by security modules and actual operational rules of the administrator on the target system. For example, if file C should be retained under the latest security protection rules, but the administrator manually deletes file C, or sets a policy to delete file C, then this operation also needs to be integrated into the security protection rules.

[0081] In a preferred embodiment, determining whether to re-implant the corresponding data into the reset virtual environment based on the matching processing method includes: If the matching disposal method is to keep the file, then the target file will be replanted; If the matching handling method is file deletion, the decision on whether to replant the target file is based on the execution time of the deletion command.

[0082] If security rules determine that a target file needs to be deleted, it should be ensured that the corresponding target file should not exist in the reset virtual environment. Selectively not reinstalling the target file during reinstallation can reduce the workload. When attackers analyze and verify the target file, they may find that the virtual honeypot unit's operation strategy for the target file is essentially the same as the real system's operation strategy, thereby improving the deception capability.

[0083] However, in some scenarios, deleting a target file from the target system may not be done immediately. Instead, a timeout is set for the deletion command, and the file is deleted only after the timeout is reached. In other words, if security rules determine that a target file needs to be deleted, the system first checks if an execution timeout exists. If not, the target file does not need to be reinstalled into the reset virtual environment. If an execution timeout exists, it checks if the timeout has been reached before reinstalling the target file into the reset virtual environment. If it has, no reinstallation is performed; otherwise, the reinstallation process is initiated first, and the reinstalled target file is deleted only after the execution timeout is reached.

[0084] During the data reimplantation process, the latest security rules are used to determine whether the target file needs to be reimplanted. If reimplantation is required, the target file is reimplanted into the reset virtual environment. If reimplantation is not required, it is necessary to determine whether to reimplant first and then delete, or not to perform the reimplantation process at all. The more sophisticated the attacker's strategy for identifying virtual honeypots, the more deceptive the technical solution becomes, and the less likely the virtual honeypot unit is to be identified by attackers.

[0085] As mentioned above, files other than the target file in a disguised file generally need to be reinstalled. However, if a file needs to be deleted based on the latest security protection rules, it does not need to be reinstalled. The verification process for whether or not to reinstall the file is the same as the process for reinstalling the target file.

[0086] The above embodiments are only used to illustrate the technical methods of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical methods of the present invention without departing from the spirit and scope of the technical methods of the present invention.

Claims

1. A network attack defense system based on virtual honeypots, characterized in that, include: Lightweight probe: Used to collect basic system characteristics of the target system; where the target system is the real system to be simulated, and the basic system characteristics include static system characteristics and dynamic behavior characteristics; Virtual honeypot module: used to extract the static system features from the basic system features; to simulate and construct a virtual environment based on the static system features; and, Used to extract the dynamic behavior features from the basic system features; and to dynamically adjust the virtual environment based on the dynamic behavior features to obtain a virtual honeypot unit; Simulation based on the aforementioned static system characteristics includes: Analyze the static system characteristics and extract static system data from them; A virtual environment is constructed using the static system data; wherein the virtual environment has the same static behavior as the target system. Dynamically adjusting the virtual environment based on the aforementioned dynamic behavioral characteristics includes: Extract dynamic behavior data from the dynamic behavior features; The time parameters in the dynamic behavior data are differentially adjusted to obtain target adjustment parameters; the virtual environment is dynamically adjusted based on the target adjustment parameters to obtain a virtual honeypot unit; Identify files created by the attacker within the virtual honeypot unit, including: Real-time detection of changed files in the virtual honeypot unit; wherein changed files include newly created files or modified files; Determine whether the modification process of the modified file conforms to the file modification process of the virtual environment; if yes, it is determined that the file was created by the virtual environment; otherwise, it is determined that the file was created by the attacker and marked as the target file. The processing method for the target file is matched according to the security protection rules in the dynamic behavior characteristics, including: Extract security protection rules from the dynamic behavioral characteristics; The security protection rules are used to match the handling method of the target file; wherein, the handling method includes deleting the target file or retaining the target file; Before resetting the virtual honeypot unit, the data assets that need to be saved in the virtual honeypot unit are detected; the data assets that need to be retained are stored in isolation. When the virtual honeypot unit is reset, data is selected from the retained data assets and replanted into the reset virtual environment to obtain the reset virtual honeypot unit; Detecting the data assets that need to be retained in the virtual honeypot unit includes: Detect disguised data and attack log data in the virtual honeypot unit; the disguised data is used to prevent attackers from noticing that the virtual honeypot unit has been reset, and the disguised data includes target files; The disguised data and the attack record data are packaged separately and then integrated as data assets that need to be retained. Select data from preserved data assets and replant it into the reset virtual environment, including: Extract disguised data from the retained data assets and verify the replantability of the disguised data based on security protection rules; The verified spoofed data is then re-implanted into the reset virtual environment.

2. The network attack defense system based on virtual honeypots according to claim 1, characterized in that, The replantability verification of the disguised data is performed based on security protection rules, including: Before replanting, extract the latest security protection rules; based on these security protection rules, match the processing method for the target data in the disguised data; The decision on whether to reinstall the target file in the reset virtual environment will be based on the matching handling method.

3. The network attack defense system based on virtual honeypots according to claim 2, characterized in that, The decision on whether to re-implant the corresponding data into the reset virtual environment depends on the matching process, including: If the matching disposal method is to keep the file, then the target file will be replanted; If the matching handling method is file deletion, the decision on whether to replant the target file is based on the execution time of the deletion command.

Images