Agent-free honeypot mapping method and device

Abstract

The invention discloses an agent-free honeypot mapping method and device, and relates to the technical field of network security. The method comprises the following steps: analyzing metadata of core switching equipment, and establishing a domain-address mapping matrix; periodically detecting an address space, constructing an IP asset dynamic portrait and generating an asset state map; deploying a cross-domain traffic forwarding protocol stack and a virtual domain identifier mapping rule; deploying a software-defined virtual switching unit and accessing the virtual honeypot probe cluster; allocating idle addresses for the probes and establishing a binding relationship; and periodically detecting and triggering a self-healing process when an address conflict occurs. The device comprises a core exchange and domain management unit, an IP asset detection unit, a network protocol configuration unit, a probe virtualization management unit, an address resource scheduling unit and a system cooperative control unit. According to the method, agency-free and automatic deployment of the honeypot is realized, and the problems that a traditional scheme depends on agency software, deployment is complex and IP conflict processing lags are solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a proxy-free honeypot mapping method and device. BACKGROUND

[0002] In the field of network security, honeypot probes are the core tools for detecting network attacks and collecting attack features. The existing honeypot probe deployment scheme mainly has the following defects: Dependence on proxy software, high deployment cost: The traditional scheme requires installing proxy software on the business terminal to realize network access and data forwarding, which not only increases the resource load of the business terminal, but also leads to long deployment period and high maintenance difficulty due to the need to adapt to different operating systems. For special scenarios such as embedded devices and industrial control terminals, it is even impossible to install proxy software, resulting in limited coverage of the probe.

[0003] IP address conflict processing lag, high business risk: After assigning an idle IP address to the probe, if the business needs to use the IP, the existing scheme relies on manual investigation (such as ping, arp commands), the processing period is long (usually 1-2 hours), and it is easy to make mistakes. Unprocessed conflicts can cause business interruption, resulting in a high risk of service unavailability.

[0004] Therefore, there is an urgent need in the art for a proxy-free, self-adaptive, and highly reliable honeypot mapping method and device to solve the above technical problems. SUMMARY

[0005] The purpose of the present application is to provide a proxy-free honeypot mapping method and device, to realize the proxy-free and automated deployment of honeypot probes, effectively solve the problems of dependence on proxy software, complex deployment, and IP conflict processing lag in traditional schemes, and significantly improve the efficiency and reliability of network security protection.

[0006] To achieve the above purpose, the technical solution adopted by the present application is as follows: A proxy-free honeypot mapping method, comprising the following steps: S1: Analyzing the domain management metadata of the network core switching device to define the target virtual local area network (VLAN) cluster and the corresponding address space, and establishing a domain-address mapping matrix; S2: Periodically detecting the address space, constructing an IP asset dynamic portrait based on the detection results, classifying the IP addresses into business-related addresses and idle address resources according to the portrait, and generating an asset state atlas; S3: Deploying a cross-domain traffic forwarding protocol stack on the core switching device and defining a virtual domain identifier mapping rule; S4: deploying a software-defined virtual switching unit at the probe management node, and connecting the honeypot probe cluster to the software-defined virtual switching unit through a virtualization interface; S5: based on the asset state graph and the domain-address mapping matrix, allocating idle address resources to the honeypot probe, and establishing a binding relationship between the probe and the address; S6: periodically repeating network detection, and when detecting that an allocated address has a conflict, automatically triggering an address self-healing process to release the binding relationship and update resource configuration.

[0007] Further, in step S1: The domain management metadata includes a virtual local area network identifier, a virtual local area network name, associated IP subnet information, and a port membership relationship. The domain-address mapping matrix is a two-dimensional relationship table, with rows representing different VLANs and columns containing the network segment address range, subnet mask, and gateway address attributes of the VLAN.

[0008] Further, in step S2: The periodic network detection uses multi-dimensional detection technology, including connectivity verification, port behavior analysis, and address binding relationship tracing; The asset state graph records the state, last response time, bound MAC address, open port list, and classification basis of each IP address.

[0009] Further, in step S3: The deployed cross-domain traffic forwarding protocol stack includes configuring the physical port of the core switching device connected to the probe virtualization management unit as IEEE 802.1Q Trunk mode; The virtual domain identifier mapping rule is VLAN tag-based identifier mapping.

[0010] Further, step S5 further includes: based on the address resource matching strategy of the probe function attribute, address allocation is performed, and after establishing the binding relationship, address allocation information is recorded in the probe communication identifier list.

[0011] Further, in step S6: the address self-healing process includes event reporting and work order creation, instruction issuance, execution of unbinding, resource back-annotation and update, probe recovery, and process confirmation.

[0012] Another object of the present application is to provide a proxy-free honeypot mapping device that performs the proxy-free honeypot mapping method, comprising: A core switching and domain management unit is responsible for virtual domain cluster management and address space governance, and supports cross-domain traffic forwarding. The IP asset detection unit is connected to the core switching and domain management unit through an IP data link, is used for obtaining asset detection data of each virtual domain, and realizes dynamic portrait construction and state classification of IP assets. The network protocol configuration unit is connected to the core switching and domain management unit through a remote control link, and is used for configuring a cross-domain forwarding protocol stack and a label rule of the core switching and domain management unit. The probe virtualization management unit is connected to a cross-domain forwarding port of the core switching and domain management unit through a high-speed data transmission link, and is used for receiving virtual domain traffic. The address resource scheduling unit is connected to the probe virtualization management unit and the system cooperative control unit through a control signaling and data interaction bus, and is used for managing an idle address resource pool, allocating a probe address, and performing identification mapping. The system cooperative control unit is connected to the IP asset detection unit, the address resource scheduling unit and the probe virtualization management unit through a distributed cooperative network, is used for storing an asset state atlas and a probe communication identification list, receiving conflict event metadata, and triggering an address self-healing process to coordinate cooperative operation of each unit.

[0013] Another object of the present application is to provide a computer readable storage medium storing a computer program, which, when executed by a processor, implements the agentless honeypot mapping method.

[0014] Another object of the present application is to provide an electronic device comprising a memory and a processor, the memory being used to store a computer program, and the processor being used to run the computer program to make the electronic device execute the agentless honeypot mapping method.

[0015] In summary, the present application has at least one of the following beneficial technical effects: Agentless deployment, realizing lightweight access: address resource direct mapping replaces terminal agent software, significantly reducing deployment complexity and terminal resource occupation, and improving adaptability to special business scenarios; Cross-domain adaptive deployment, improving network adaptability: through an optimized cross-domain traffic forwarding protocol stack and virtual domain identification mapping, the configuration process is simplified, complex network topology can be flexibly adapted, and stable traffic forwarding is ensured; Address conflict self-healing, ensuring business continuity: through periodic asset detection and self-healing mechanism, the address conflict processing period is shortened from hours to minutes, without manual intervention, greatly reducing the risk of business interruption; In summary, this invention enables agentless and automated deployment of honeypot probes, effectively solving the problems of traditional solutions relying on proxy software, complex deployment, and lagging IP conflict handling, and significantly improving the efficiency and reliability of network security protection. Attached Figure Description

[0016] Figure 1 This is a schematic diagram of the method flow of the present invention; Figure 2 This is a block diagram of the device structure of the present invention. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. Furthermore, the technical features involved in the various embodiments of this invention described below can be combined with each other as long as they do not conflict with each other.

[0018] This embodiment provides a proxyless honeypot mapping method, such as... Figure 1 As shown, it includes the following steps: S1: Parse the domain management metadata of the network core switching device to define the target virtual LAN VLAN cluster and its corresponding address space, and establish a domain-address mapping matrix; S2: Perform periodic network probing of the address space, construct a dynamic profile of IP assets based on the probing results, classify IP addresses into business-related addresses and idle address resources, and generate an asset status map; S3: Deploy a cross-domain traffic forwarding protocol stack on the core switching equipment and define virtual domain identifier mapping rules; S4: Deploy a software-defined virtual exchange unit on the probe management node, and connect the honeypot probe cluster to the software-defined virtual exchange unit through a virtualization interface; S5: Based on the asset status map and domain-address mapping matrix, allocate free address resources to honeypot probes and establish a binding relationship between probes and addresses; S6: Periodically repeat network probing, and automatically trigger the address self-healing process to remove the binding relationship and update the resource configuration when a conflict is detected in the allocated address.

[0019] The following is a detailed description with reference to specific embodiments.

[0020] S1: Parse the domain management metadata of the network core switching device to define the target virtual local area network (VLAN) cluster and its corresponding address space, and establish a domain-address mapping matrix.

[0021] This step is to accurately and automatically obtain and understand the global logical structure of the current network by the network management device, which can be a standalone network management system server or a management module integrated on the core switch device.

[0022] A communication connection is established with the core switch device through a standardized southbound interface (such as SNMP, NETCONF / YANG model, or CLI connected through SSH). The primary operation is to automatically collect and parse the domain management metadata defined in the core switch device configuration. These metadata are the digital definition of the network structure, at least containing the following key information: Virtual Local Area Network Identifier: VLAN ID, such as VLAN 10, VLAN 20.

[0023] Virtual Local Area Network Name: A descriptive name for the administrator to identify, such as R&D network segment, finance VLAN.

[0024] Associated IP Subnet Information: Clearly specifies the IP address range and subnet mask corresponding to each VLAN, for example, VLAN 10 corresponds to the network segment 192.168.10.0 / 24, VLAN 20 corresponds to the network segment 192.168.20.0 / 24, which defines the address space boundary of each logical domain.

[0025] Port Membership: Records the VLAN to which the physical switch port belongs, whether it is in Access mode or Trunk mode.

[0026] The parsing process is not simply recording, but logical association and integration. The network management device can accurately define the target VLAN cluster that needs to deploy the honeypot probe by analyzing these metadata. For example, if the security policy requires security monitoring for the R&D network (VLAN 10), test network (VLAN 30), and DMZ area (VLAN 50), these three VLANs and their corresponding address spaces are defined as the target cluster.

[0027] On this basis, the network management device constructs a structured domain-address mapping matrix in memory or an embedded database. This matrix is logically a two-dimensional relationship table, with rows representing different VLANs and columns containing key attributes such as the network segment address range, subnet mask, gateway address, etc. of the VLAN. Its physical storage can be a table in a relational database or a hash map in the application memory with VLAN ID as the key for fast query. This matrix serves as the "network map" of the entire system, providing an indispensable and accurate topology benchmark for subsequent asset detection, traffic scheduling, and address allocation, ensuring that the deployment of honeypot probes covers all network domains that need to be monitored, avoiding deployment blind spots. The matrix structure contains the following fields: Virtual local area network identifier (vlan_id): integer data, representing the unique numerical identifier of the virtual local area network, such as 10, 20, 30.

[0028] Virtual local area network name (vlan_name): string data, representing the descriptive name of the virtual local area network, such as R&D-VLAN, Finance-VLAN.

[0029] Network address block (subnet_cidr): string data, using CIDR notation to accurately describe the IP address range and subnet prefix length corresponding to the VLAN, such as 192.168.10.0 / 24.

[0030] Gateway address (gateway_ip): string data, representing the default gateway IP address of the VLAN, such as 192.168.10.1.

[0031] Subnet mask (subnet_mask): string data, representing the subnet mask of the VLAN, such as 255.255.255.0.

[0032] Starting IP address (start_ip): string data, defining the starting point of the available IP address range within the VLAN, such as 192.168.10.2.

[0033] Ending IP address (end_ip): string data, defining the end point of the available IP address range within the VLAN, such as 192.168.10.254.

[0034] S2: Periodic network probing of address space, constructing IP asset dynamic portrait based on probing results, classifying IP addresses into business-related addresses and idle address resources, and generating asset status atlas.

[0035] Dynamic and continuous state awareness and resource classification of the static address space defined by S1. The IP asset probing unit reads the IP address list of all target VLANs from the domain-address mapping matrix generated by S1. Subsequently, it initiates periodic, multi-dimensional automated network probing. The probing period is not fixed but configurable and adaptive. For example, set a longer period (such as 1 hour) during stable business hours at night, and automatically shorten the period (such as 15 minutes) during working hours or during known frequent network changes, to balance the timeliness of probing and network load.

[0036] Periodic network probing of target IP addresses, sequentially performing connectivity verification, port behavior analysis, and address binding relationship tracing, specifically: Connectivity verification: mainly using ICMP protocol (such as Ping command). Send ICMP EchoRequest packet to target IP address, and judge whether the IP address is online and has basic network response ability according to whether Echo Reply is received.

[0037] Port behavior analysis: using TCP / SYN scanning or UDP scanning. Scan the commonly used service ports (such as 22 / SSH, 80 / HTTP, 443 / HTTPS, 3389 / RDP, etc.) of the target IP address. By analyzing the open / close / filter state of the port and the Banner information obtained in the handshake process, it can be inferred that the operating system, service type and version running on the address, which is the key to identifying business applications.

[0038] Address binding relationship tracing: by querying the ARP table (for IPv4) or neighbor discovery cache (for IPv6) of the core switch device or each access layer switch, the corresponding relationship between IP address and terminal physical address (MAC address) is obtained. This helps to trace back the specific physical device corresponding to the IP address, and is a strong evidence to judge whether the address is occupied by a real terminal.

[0039] Based on the above detection results, the IP asset detection unit will construct a dynamically updated asset dynamic portrait for each IP address. The portrait is not a single attribute, but a multi-dimensional attribute label that integrates the activity of the address, service type, communication opposite, device fingerprint, etc.

[0040] Subsequently, the IP asset detection unit will clearly divide the entire address space into two categories according to the preset intelligent classification strategy. The execution process of the intelligent classification strategy includes the following steps: 1. Input and detection: obtain the target IP address and perform ICMP connectivity verification, preset service port scanning and ARP binding relationship query.

[0041] 2. Business address determination: if any of the following conditions is met, the IP address will be classified as a business-related address immediately: ICMP Echo Request packet receives valid reply; port scanning finds that at least one TCP or UDP service port is in open (Open) state; ARP table or neighbor cache has a binding record of the IP address and valid MAC address.

[0042] 3. Idle address determination: if all the above business address determination conditions are not met, further check the historical records. If the IP address has not triggered any business address determination condition in the last three detection periods, it will be classified as an idle address resource.

[0043] 4. Status update: update the decision result (business-associated address or idle address resource) and its basis (e.g. "ICMP non-response, port all closed, ARP no binding") to the asset dynamic portrait of the IP address.

[0044] Based on the above strategy, the address space is classified as: Business-associated address: refers to an address that shows active communication behavior within the detection period. Specifically, it responds to ICMP requests, has one or more business ports in an open listening state, or has a stable binding relationship with a specific terminal MAC address. These addresses are core resources of the production environment and must be strictly protected to avoid being occupied by probes.

[0045] Idle address resource: refers to an address that does not show any of the above active characteristics in consecutive detection periods. That is, there is no ICMP response, no open port, and no corresponding MAC address record in the ARP table. These addresses constitute a "address resource pool" that can be safely and harmlessly used by honeypot probes.

[0046] Finally, update the decision result and detailed basis to the asset status map. The IP asset detection unit integrates the classification results to generate a global asset status map. The map exists in the form of structured data such as a database or JSON, recording the status, last response time, bound MAC address, open port list, and classification basis of each IP address. This map is synchronized in real-time to the system collaborative control unit, providing accurate and dynamic data support for address scheduling decisions of S5. The map is a complex data structure with IP address as the key (Key), which can exist in the form of NoSQL documents (such as JSON format) or memory objects, used to dynamically record comprehensive status information of each IP address. The value corresponding to each IP address contains the following attributes: Status (status): enumeration data, identifies the current status of the IP address, with optional values: 'occupied' (indicates being occupied by business), 'idle' (indicates idle resource), 'probe' (indicates being occupied by probe).

[0047] Last responded time (last_responded): timestamp data, records the time of the last response of the IP address to network detection, using ISO 8601 standard format.

[0048] MAC address (mac_address): string data, records the physical device MAC address bound to the IP address through ARP table query; if there is no binding relationship, the value is null (null).

[0049] Open ports: An integer array recording the port numbers of services in open listening state discovered by port scanning, e.g., [22, 80, 443].

[0050] OS fingerprint: String data recording the type and version of operating system inferred by protocol stack fingerprinting; if it cannot be identified, the value is null.

[0051] Classification reason: String data recording the detailed reason and basis for classifying the IP address as the current state in text form, e.g., "responding to ICMP request, detecting 80 / 443 port open".

[0052] Last updated: Timestamp data recording the last time the entry information was updated.

[0053] Therefore, this step fundamentally avoids the risk of misdeploying the honeypot probe to the business address and causing service interruption.

[0054] S3: Deploy cross-domain traffic forwarding protocol stacks on the core switching device and define virtual domain identifier mapping rules.

[0055] This step can break the isolation between various virtual domains (VLANs) and build a general-purpose channel for the centralized probe cluster that can receive and distinguish traffic from different VLANs. The network protocol configuration unit programmatically configures the core switching device through remote configuration protocols (e.g., using the Set operation of SNMP to modify the port VLAN membership, or through NETCONF to issue configuration data conforming to the YANG model). The target object of the configuration is a specific physical port on the core switching device that is physically connected to the probe virtualization management unit. Change the working mode of this physical port from the default Access mode to the IEEE 802.1Q Trunk mode. In Trunk mode, further authorization is needed through the "allowed VLAN" list to explicitly authorize the traffic of all target VLANs in S1 to pass through this port. For example, execute the command to authorize VLAN 10, 30, 50 traffic to pass through. This makes the port a shared, multi-VLAN traffic-carrying highway entrance.

[0056] To ensure that the VLAN identity is not lost, precise virtual domain identity mapping rules must be defined. This is essentially the process of correctly understanding and handling VLAN Tags. The network protocol configuration unit ensures that the core switching device, when forwarding traffic from any VLAN (e.g. VLAN 10) through this Trunk port, will insert (encapsulate) an 802.1Q tag containing the VLAN ID (i.e. 10) in the header of the Ethernet frame. This tag is the "virtual domain identity card" of the data frame, ensuring that the virtual domain information of the traffic is completely passed on during the forwarding process from the core switching device to the probe virtualization management unit, achieving lossless forwarding. Correspondingly, the virtual switching interface on the probe management unit side must also be configured to be able to recognize and process frames with VLAN Tags. The cross-domain traffic transmission channel constructed is the basis for a single probe cluster to serve multiple VLANs.

[0057] S4: Deploy a software-defined virtual switching unit on the probe management node, and connect the honeypot probe cluster to the software-defined virtual switching unit through a virtualization interface.

[0058] Using virtualization technology, physical probe resources are converted into logical resources that can be flexibly scheduled and densely deployed. The execution subject is the probe virtualization management unit, whose physical carrier is usually a high-performance x86 server (probe management node).

[0059] First, a software-defined virtual switching unit, such as the open-source Open vSwitch, is deployed on the host operating system (e.g. Linux) of the server. As a high-performance software switch running in user mode, OVS has complete Layer 2 forwarding, VLAN processing, flow table control, and other functions, with performance close to that of a physical switch.

[0060] Subsequently, the honeypot probe cluster is instantiated. Each honeypot probe (possibly running Dionaea, Kippo, or other honeypot software) is not in the form of a physical device, but is encapsulated as a lightweight virtualization instance, such as a Docker container or a KVM-based micro virtual machine. These probe instances are connected to the OVS through a virtualization access adaptation interface. Specifically, a virtual network interface (veth pair or TAP device) is created for each probe instance, with one end inside the container / virtual machine and the other end connected to a logical port on the OVS.

[0061] The port mapping strategy of the switching unit is configured to ensure that each probe corresponds to an independent traffic access channel and supports receiving virtual domain traffic forwarded across domains. The port mapping strategy of the OVS is defined, and the core of the strategy is to establish a correspondence between the VLAN Tag and the virtual port. An administrator configures a flow table rule through a command line tool of the OVS, and instructs the OVS to: when receiving a data frame from the Trunk link of the core switch and with a specific VLAN Tag (for example, VLAN 10), the data frame is forwarded to the virtual port of the probe instance that is previously bound with the VLAN 10. This means that although all probe instances share the same physical server and the same OVS, each probe has a logically completely independent traffic access channel that is exclusively used for the corresponding VLAN, and accurate distribution and strict isolation of traffic are achieved. The above process greatly simplifies physical deployment and realizes intensive management of probe resources.

[0062] S5: Based on the asset state graph and the domain-address mapping matrix, the idle address resources are allocated to the honeypot probe, and a binding relationship between the probe and the address is established.

[0063] The address resource scheduling unit obtains two key data from the system cooperative control unit through an internal data bus: one is the idle address resource pool in the asset state graph generated in S2; and the other is the virtual domain-address mapping matrix established in S1.

[0064] Based on the information, the address resource scheduling unit first needs to configure a fine virtual domain identification mapping relationship on the software-defined virtual switching unit (OVS) in S4 to ensure logical correctness.

[0065] Subsequently, the core address allocation operation is performed. It adopts an address resource matching strategy based on the function attribute of the probe. The specific execution steps of the strategy are as follows: 1. Strategy input: the address resource scheduling unit obtains the metadata of the honeypot probe to which the address is to be allocated, wherein the metadata includes the service type (such as "Web service", "SSH service") to be emulated by the probe.

[0066] 2. Feature mapping: according to a predefined "service type-port mapping table", the typical network port associated with the target service is determined. For example: The service type "Web service" is mapped to the port list [80, 443].

[0067] The service type "SSH service" is mapped to the port list

[22] .

[0068] The service type "remote desktop service" is mapped to the port list

[3389] .

[0069] 3. Address screening: In the free address resource pool corresponding to the target VLAN, screen out the IP addresses that contain the above mapping port in the "open port list" field in the historical record of the asset state map.

[0070] 4. Allocation execution: If there are candidate addresses that meet the conditions after screening, select one of them for allocation; if there are no such addresses, randomly allocate an address from the free address pool.

[0071] For example, a honeypot probe designed to simulate a web service, the system may prefer to allocate an IP address from the resource pool that has historically had 80 / 443 port behavior as "idle". The address resource scheduling unit selects a suitable IP address from the free address resource pool (for example, allocate IP 192.168.10.100 for the probe in VLAN 10), and establishes a "probe-address" binding relationship on the OVS through API calls or configuration scripts. This is usually achieved by configuring static flow tables or policy routing, so that all traffic to 192.168.10.100 is accurately forwarded to the corresponding probe instance.

[0072] After the binding is completed, the IP address is immediately recorded in the probe communication identifier list. This list is a special list maintained by the address resource scheduling unit, used to accurately track and manage network address resources occupied by honeypot probes. Its structure includes the following fields: IP address (ip_address): string data, records the IP address occupied by the honeypot probe instance.

[0073] Virtual local area network identifier (vlan_id): integer data, records the virtual local area network ID to which the IP address belongs.

[0074] Probe instance identifier (probe_id): string data, records the unique identifier of the honeypot probe instance that occupies the address.

[0075] Allocation time (assigned_at): timestamp data, records the exact time when the address was allocated to the probe.

[0076] Binding configuration hash (binding_config_hash): string data, records the configuration hash value of the flow table or routing rule created on the software-defined virtual switch unit (such as OVS) corresponding to this binding relationship; this value is used to quickly locate and delete related configurations when the binding needs to be removed.

[0077] S6: Periodically repeat network probing, and when a conflict is detected in an allocated address, automatically trigger the address self-healing process to remove the binding relationship and update the resource configuration.

[0078] Its operation is a continuous iterative cycle. IP asset detection unit according to S2 set adaptive cycle, repeatedly execute detection logic, but will pay special attention to those have been marked as "probe communication identification" IP address.

[0079] After the completion of the detection, the IP asset detection unit will compare the latest detection results with the "probe communication identification" list held by the system collaborative control unit. The conflict determination standard is: if an address in the list (such as 192.168.10.100) is identified as a "business association address" (for example, the address starts to respond to Ping request, opens a new non-probe port, or binds a new unknown MAC address) in the current detection, it is immediately determined that an address conflict has occurred. This usually means that a new business device has been manually configured with the IP address by the operation and maintenance personnel.

[0080] Once the conflict is detected, the IP asset detection unit will immediately encapsulate the conflict event metadata (including conflict IP, VLAN, timestamp, detected MAC address, etc.) and report it to the system collaborative control unit through a high-priority message channel.

[0081] The system collaborative control unit, as the brain, automatically triggers the address self-healing process immediately after receiving the conflict event. This process includes a series of operations: Event reporting and ticket creation: the system collaborative control unit receives the event and generates a unique ticket ID; Instruction issuance: through message queue (such as RabbitMQ) or RPC call, issue self-healing instructions containing conflict IP and ticket ID to address resource scheduling unit; Execution unbinding: the address resource scheduling unit finds the binding configuration hash value corresponding to the IP according to the probe communication identification list, and uses the hash value to accurately locate and delete the corresponding flow table or routing configuration item through the management interface of the software-defined virtual switch unit, thereby unbinding the address; Resource back-annotation and update: update the conflict IP state to conflict and move it to the address resource pool isolation area; notify the IP asset detection unit to update the asset state map; Probe recovery: the address resource scheduling unit re-executes the address allocation strategy (S5) to allocate a new address for the affected probe; Process confirmation: the address resource scheduling unit sends a completion confirmation to the system collaborative control unit, and the ticket is closed.

[0082] This mechanism realizes full automation and closed-loop processing of address resource conflicts, compresses the process that requires manual intervention for several hours in traditional solutions to minutes without human intervention, greatly guarantees business continuity and the persistence of probe services, and ensures long-term stable operation of the system, achieving complete automation of operation and maintenance.

[0083] The embodiment provides a proxy-free honeypot mapping device which executes the proxy-free honeypot mapping method. A core switch and domain management unit is configured to be responsible for virtual domain cluster management and address space governance and support cross-domain traffic forwarding. An IP asset detection unit is connected to the core switch and domain management unit through an IP data link, configured to obtain asset detection data of each virtual domain, and realize dynamic portrait construction and state classification of IP assets. A network protocol configuration unit is connected to the core switch and domain management unit through a remote control link, configured to configure a cross-domain forwarding protocol stack and a label rule of the core switch and domain management unit. A probe virtualization management unit is connected to a cross-domain forwarding port of the core switch and domain management unit through a high-speed data transmission link, configured to receive virtual domain traffic; the probe virtualization management unit comprises a probe management node, a software-defined virtual switching unit and a honeypot probe cluster, configured to realize intensive access and traffic aggregation of probes through a virtualization interface. An address resource scheduling unit is connected to the probe virtualization management unit and a system cooperative control unit through a control signaling and data interaction bus, configured to manage an idle address resource pool, allocate a probe address and perform identification mapping. A system cooperative control unit is connected to the IP asset detection unit, the address resource scheduling unit and the probe virtualization management unit through a distributed cooperative network, configured to store an asset state atlas and a probe communication identification list, receive conflict event metadata, and trigger an address self-healing process to coordinate cooperative operation of each unit.

[0084] The embodiment provides a computer readable storage medium which stores a computer program, and the computer program is executed by a processor to realize the proxy-free honeypot mapping method.

[0085] The embodiment provides an electronic device which comprises a memory and a processor, the memory is configured to store a computer program, and the processor is configured to run the computer program to enable the electronic device to execute the proxy-free honeypot mapping method.

[0086] In conclusion, the honeypot probe is deployed in a proxy-free and automatic manner, the problems of dependence on proxy software, complex deployment and lag in IP conflict processing in the traditional scheme are solved, and the efficiency and reliability of network security protection are improved.

[0087] Embodiments of the present application can be provided as a method, a system, or a computer program product. Accordingly, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, and the like) embodying computer-readable program code.

[0088] The present application is described in reference to the flowchart and / or block diagrams of the method, apparatus (system) and computer program product according to embodiments of the present application. It is understood that each block of the flowchart and / or block diagrams, and combinations of blocks in the flowchart and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart and / or block diagrams block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks.

[0089] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the function specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks.

[0090] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks.

[0091] The content described in the present application specification which is not described in detail is the prior art known to the person skilled in the art. It is hereby indicated that the above description helps the person skilled in the art to understand the present application, but does not limit the protection scope of the present application. Any equivalent replacement, modification, improvement and deletion of the above description without departing from the essential content of the present application falls within the protection scope of the present application.

Claims

1. An agentless honeypot mapping method, characterized in that, The method comprises the following steps: S1: Analyzing the domain management metadata of the network core switching device to define a target virtual local area network (VLAN) cluster and a corresponding address space, and establishing a domain-address mapping matrix; S2: Periodically performing network detection on the address space, constructing an IP asset dynamic portrait based on the detection results, classifying IP addresses into business-related addresses and idle address resources according to the IP asset dynamic portrait, and generating an asset state atlas; S3: Deploying a cross-domain traffic forwarding protocol stack on the core switching device, and defining a virtual domain identifier mapping rule; S4: Deploying a software-defined virtual switching unit on a probe management node, and connecting a honeypot probe cluster to the software-defined virtual switching unit through a virtualization interface; S5: Based on the asset state atlas and the domain-address mapping matrix, allocating idle address resources to the honeypot probe, and establishing a binding relationship between the probe and the address; S6: Periodically repeating the network detection, and automatically triggering an address self-healing process to remove the binding relationship and update the resource configuration when a conflict of an allocated address is detected.

2. The agentless honeypot mapping method of claim 1, wherein, In step S1: The domain management metadata includes a virtual local area network identifier, a virtual local area network name, associated IP subnet information, and a port membership relationship; The domain-address mapping matrix is a two-dimensional relationship table, with rows representing different VLANs and columns including the address range, subnet mask, and gateway address attributes of the VLAN.

3. The agentless honeypot mapping method of claim 1, wherein, In step S2: The periodic network detection uses multi-dimensional detection technology, including connectivity verification, port behavior analysis, and address binding relationship tracing; The asset state atlas records the state, last response time, bound MAC address, open port list, and classification basis of each IP address.

4. The agentless honeypot mapping method of claim 1, wherein, In step S3: The deployment of the cross-domain traffic forwarding protocol stack includes configuring the physical port of the core switching device connected to the probe virtualization management unit in IEEE 802.1Q Trunk mode; The virtual domain identifier mapping rule is an identifier mapping based on the VLAN tag.

5. The agentless honeypot mapping method of claim 1, wherein, Step S5 further includes: performing address allocation based on the address resource matching strategy of the probe function attribute, and recording the address allocation information in the probe communication identifier list after establishing the binding relationship.

6. The agentless honeypot mapping method of claim 1, wherein, In step S6: The address self-healing process includes event reporting and work order creation, instruction issuance, execution of unbinding, resource back-annotation and update, probe recovery, and process confirmation.

7. An agentless honeypot mapping apparatus, comprising: The device performs a proxy-free honeypot mapping method according to any one of claims 1-6, comprising: A core switching and domain management unit for managing virtual domain clusters and address spaces, and supporting cross-domain traffic forwarding; An IP asset detection unit connected to the core switching and domain management unit through an IP data link, for obtaining asset detection data of each virtual domain, and implementing IP asset dynamic portrait construction and state classification; A network protocol configuration unit connected to the core switching and domain management unit through a remote control link, for configuring the cross-domain forwarding protocol stack and label rules of the core switching and domain management unit; A network protocol configuration unit connected to the core switching and domain management unit through a remote control link, for configuring the cross-domain forwarding protocol stack and label rules of the core switching and domain management unit; The probe virtualization management unit is connected to the cross-domain forwarding port of the core switch and domain management unit through a high-speed data transmission link, and is used for receiving virtual domain traffic; the probe virtualization management unit comprises a probe management node, a software-defined virtual switch unit and a honeypot probe cluster, and is used for realizing intensive access and traffic convergence of the probe through a virtualization interface; The address resource scheduling unit is connected to the probe virtualization management unit and the system cooperative control unit through control signaling and a data interaction bus, and is used for managing an idle address resource pool, allocating a probe address and mapping an identifier; The system cooperative control unit is connected to the IP asset detection unit, the address resource scheduling unit and the probe virtualization management unit through a distributed cooperative network, is used for storing an asset state atlas and a probe communication identifier list, receiving conflict event metadata, and triggering an address self-healing process to coordinate cooperative operation of each unit.

8. A computer-readable storage medium, characterized in that, The computer program is stored in the memory and is executed by the processor to implement the agentless honeypot mapping method in any one of claims 1-6.

9. An electronic device, comprising: The electronic device comprises a memory and a processor, the memory is used for storing a computer program, and the processor executes the computer program to enable the electronic device to perform the agentless honeypot mapping method in any one of claims 1-6.

Images