Attack behavior tracing method and system in honeycomb environment

Abstract

The application discloses a kind of attack behavior tracing method and system under honey yard environment, method includes: when detecting attack behavior in honey yard environment, real-time attack trapping path is matched with preset navigation path, and candidate node set satisfying multidimensional determination condition is screened out;By calculating the absolute difference value of the distance of each node and attack source with preset threshold value, the optimal tracing node is selected;Detect whether there is hidden jump node based on intelligence, protocol and topological feature determination on the link between the node and attack source;If there is, then the attack position variation in the monitoring time window is counted, and by comparing with dynamic threshold, it is adaptively decided whether to plan a two-way prediction path for comparison or switch to the reverse tracking direction.The application solves the problems of inaccurate path screening, inaccurate node positioning, insufficient hidden identification and direction fixation, and improves the accuracy, continuity and adaptive ability of tracing.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a method and system for tracing attack behavior in a honeynet environment. BACKGROUND

[0002] As an active defense technology, the honeynet environment attracts attackers by deploying decoy nodes and simulating services, and records their behaviors to provide high-value data for security analysis. Attack behavior tracing aims to track attack paths and identify attack sources, which is the key to improving network security situational awareness.

[0003] However, the existing honeynet environment tracing technology has the following defects:

[0004] 1. Insufficient path screening accuracy: relying on static rules, it is difficult to cope with the dynamic change of the intrusion path of the attacker, resulting in deviation or interruption of the tracing path.

[0005] 2. Inaccurate node positioning: lacking a quantitative judgment mechanism combining network distance and dynamic threshold, it is easy to misselect nodes that are too close or too far.

[0006] 3. Weak ability to identify hidden nodes: relying mainly on static blacklists, it cannot effectively detect unlisted proxy, jump machine, TOR / VPN entry and other hidden jump nodes.

[0007] 4. Analysis direction is fixed: it cannot dynamically adjust the tracing direction according to the real-time volatility of attack behavior, and is inefficient in high dynamic scenarios.

[0008] 5. Lack of emergency mechanism: when an ideal path cannot be planned, the system often interrupts the analysis, and lacks redundant strategies to ensure the continuity of tracing.

[0009] 6. Poor parameter self-adaptation: key thresholds such as distance and fluctuation threshold are mostly manually preset, and it is difficult to adapt to different network topologies and attack patterns.

[0010] The distance threshold, fluctuation threshold and other key parameters in most existing solutions are manually preset, and lack the ability to dynamically adjust based on honeynet topology, average number of hops between nodes, attack behavior characteristics, etc., resulting in the problem of parameter mismatch in different network environments, affecting the accuracy and robustness of the tracing result. SUMMARY

[0011] To solve these problems, the present application provides a method and system for tracing attack behavior in a honeynet environment.

[0012] In a first aspect, the present application provides a method for tracing attack behavior in a honeynet environment, comprising the following steps:

[0013] S1, when an attack behavior is detected in the honeynet environment, dynamically matching an attack-luring analysis path generated in real time with a pre-defined attack navigation path, and screening a candidate node set meeting a traceability judgment condition from the attack navigation path;

[0014] S2, calculating a network path distance between each node in the candidate node set and a current attack behavior occurrence position, and determining an optimal traceability node from the candidate node set based on proximity of the network path distance to a pre-set traceability judgment threshold value;

[0015] S3, judging whether there is a hidden jump node on a network link between the optimal traceability node and the current attack behavior occurrence position;

[0016] If there is, it is determined that the current attack behavior traceability is not completed, and step S4 is executed;

[0017] If there is not, it is determined that the current attack behavior traceability is completed;

[0018] S4, counting a change amount of the attack behavior occurrence position in a pre-set monitoring time window, and comparing the change amount with an activity fluctuation threshold value;

[0019] If the change amount is greater than the activity fluctuation threshold value, two traceability prediction paths in opposite directions are planned for comparison and analysis;

[0020] If the change amount is not greater than the activity fluctuation threshold value, a traceability analysis direction is switched to a reverse direction opposite to a current analysis direction for reverse tracking.

[0021] In a second aspect, the present application provides an attack behavior traceability system in a honeynet environment, comprising:

[0022] An attack event node screening module, a distance evaluation and optimal node selection module, a hidden jump identification module, and a direction and prediction path planning module;

[0023] The attack event node screening module is configured to, when an attack behavior is detected in the honeynet environment, dynamically match an attack-luring analysis path generated in real time with a pre-defined attack navigation path, and screen a candidate node set meeting a traceability judgment condition from the attack navigation path;

[0024] The distance evaluation and optimal node selection module is configured to calculate a network path distance between each node in the candidate node set and a current attack behavior occurrence position, and determine an optimal traceability node from the candidate node set based on proximity of the network path distance to a pre-set traceability judgment threshold value;

[0025] The hidden jump identification module is configured to determine whether there is a hidden jump node on a network link between the optimal traceability node and the current attack behavior occurrence position; if there is, it is determined that the current attack behavior traceability is not completed, and the direction and predicted path planning module is called to perform subsequent analysis; if there is not, it is determined that the current attack behavior traceability is completed.

[0026] The direction and predicted path planning module is configured to count a change amount of the attack behavior occurrence position within a preset monitoring time window, and compare the change amount with an activity fluctuation threshold; if the change amount is greater than the activity fluctuation threshold, two traceability predicted paths in opposite directions are planned for comparison analysis; if the change amount is not greater than the activity fluctuation threshold, the traceability analysis direction is switched to the opposite direction of the current analysis direction for reverse tracking; and the direction and predicted path planning module is further configured to, in response to being unable to successfully plan the two traceability predicted paths in opposite directions, directly perform reverse tracking along a path opposite to the current analysis direction.

[0027] In a third aspect, an electronic device is provided, which includes at least one processor, and a memory connected with the at least one processor in communication, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the steps of the attack behavior traceability method in a honeynet environment according to any one of the embodiments of the present application.

[0028] In a fourth aspect, the present application further provides a computer readable storage medium having a computer program stored thereon, and the program instructions are executed by a processor to enable the processor to perform the steps of the attack behavior traceability method in a honeynet environment according to any one of the embodiments of the present application.

[0029] The attack behavior traceability method and system in a honeynet environment according to the present application have the following beneficial effects:

[0030] 1. By dynamically matching the preset attack navigation path with the attack trapping analysis path generated during running, and introducing a traceability determination condition, a suspicious node set can be filtered out from the global path in real time, the relevance and coverage of the suspicious node set are significantly improved, and irrelevant node interference is reduced.

[0031] 2. A traceability determination threshold value is introduced, and the difference absolute value comparison is performed in combination with the network path distance from the node to the attack behavior occurrence position, so that the distance between the selected optimal traceability node and the determination threshold value is closest, thereby maintaining high-precision target node positioning capability in a complex network with dense nodes.

[0032] 3. After the optimal traceability node is determined, the link is subjected to the anonymous jump node detection, covering multiple types of anonymous nodes such as proxy servers, jump machines, anonymous network entrances, and combining threat intelligence and real-time link feature recognition technology to ensure that the determination of the traceability completion state is more reliable and the risk of misjudgment is reduced.

[0033] 4. By comparing the activity position change amount in the preset monitoring time window with the activity fluctuation threshold, the dynamic adjustment of the traceability direction is realized, and when the attack path is quickly switched or the position is frequently changed, the analysis direction can be adaptively switched to a more optimal direction, thereby maintaining the continuity and effectiveness of the traceability link.

[0034] 5. When the conditions allow, the system can plan two traceability prediction paths in opposite directions for comparison and analysis, improving the tracking ability of evasive attacks; if it is not possible to plan two paths at the same time, it can directly switch to one-way tracking in the opposite direction to ensure that the traceability does not interrupt in the case of limited topology.

[0035] 6. The activity fluctuation threshold can be automatically set according to the average network hops between key nodes in the honeynet, and dynamically adjusted in combination with historical traceability data and real-time monitoring results to ensure parameter adaptability and traceability accuracy under different network structures and attack characteristics. BRIEF DESCRIPTION OF DRAWINGS

[0036] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiment description. Obviously, the drawings in the following description are some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor on the basis of these drawings.

[0037] Figure 1 The flowchart of the attack behavior traceability method in the honeynet environment provided by an embodiment of the present application;

[0038] Figure 2 The structural block diagram of the attack behavior traceability system in the honeynet environment provided by an embodiment of the present application;

[0039] Figure 3 The structural schematic diagram of the electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0040] In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0041] Referring to Figure 1 , a flowchart of an attack behavior tracing method in a honeynet environment is shown.

[0042] In step S1, when an attack behavior is detected in the honeynet environment, a candidate node set meeting a tracing judgment condition is filtered from an attack navigation path according to a real-time generated attack bait analysis path and the attack navigation path;

[0043] Specifically, the step S1 of filtering the candidate node set meeting the tracing judgment condition from the attack navigation path comprises:

[0044] S11, for each node meeting the tracing judgment condition, mark it as a candidate tracing node; wherein the tracing judgment condition is that the node has been accessed by the attack bait analysis path, the event type meets a tracing strategy, and the node has monitoring and evidence collection capabilities in the preset path;

[0045] S12, after eliminating isolated nodes that do not form effective links among all the candidate nodes, arrange the remaining candidate nodes according to their order in the attack navigation path to form the candidate node set.

[0046] In step S2, a network path distance between each node in the candidate node set and a current attack behavior occurrence position is calculated, and based on the proximity of the network path distance to a preset tracing judgment threshold value, an optimal tracing node is determined from the candidate node set;

[0047] Specifically, the step S2 of determining the optimal tracing node from the candidate node set comprises:

[0048] S21, calculate the absolute value of the difference between the network path distance of each node and the tracing judgment threshold value;

[0049] S22, select the node with the smallest absolute value of the difference as the optimal tracing node.

[0050] Step S3, judging whether there is a hidden jump node on the network link between the optimal traceability node and the current attack behavior occurrence position; if there is, determining that the current attack behavior traceability is not completed, and performing step S4; if there is not, determining that the current attack behavior traceability is completed;

[0051] Specifically, the step S3 includes:

[0052] S31, acquiring feature information of each hop on the network link, the feature information including intelligence attribution features, protocol fingerprint features, and topology timing features;

[0053] S32, calculating a hidden score of each hop through a weighted scoring model based on the feature information;

[0054] S33, if the hidden score of any hop exceeds a marked threshold, determining that the hidden jump node exists.

[0055] Step S4, counting a change amount of the attack behavior occurrence position in a preset monitoring time window, and comparing the change amount with an activity fluctuation threshold; if the change amount is greater than the activity fluctuation threshold, planning two traceability prediction paths in opposite directions for comparison and analysis; if the change amount is not greater than the activity fluctuation threshold, controlling the traceability analysis direction to switch to the opposite direction of the current analysis direction for reverse tracking.

[0056] Specifically, the activity fluctuation threshold in the step S4 is dynamically set based on the average network hop number between key nodes in the honeynet environment.

[0057] The key node refers to a node that is identified as having a high monitoring value, a high evidence collection ability, or a high probability of being attacked in a pre-defined attack navigation path.

[0058] Specifically, after the step S4 of planning two traceability prediction paths in opposite directions, the method further includes:

[0059] calculating a deviation degree of each traceability prediction path from the attack navigation path;

[0060] based on the deviation degree, selecting a direction corresponding to a path with a smaller deviation degree from the two paths as a new current analysis direction;

[0061] The deviation degree is calculated based on four factors including an order deviation of a key monitoring point in the path, a missing and detour penalty, a evidence collection reducibility, a historical consistency, and a risk context.

[0062] Key monitoring point refers to a key node, specifically those key nodes that are actually visited and trigger the traceability judgment condition in a specific attack analysis path.

[0063] Deviation degree is a quantitative index for measuring the difference between the planned traceability prediction path and the preset attack navigation path. Deviation degree is calculated by a weighted scoring model. The following factors are considered in the calculation:

[0064] 1) Sequence deviation: whether the appearance sequence of key monitoring points in the prediction path is consistent with the sequence defined in the navigation path. Sequence misplacement or reversal will produce a deviation value.

[0065] 2) Node missing and bypass penalty: if a key monitoring point defined in the navigation path does not appear in the prediction path, or the prediction path increases additional hops to bypass it, the deviation degree will increase by a preset weight.

[0066] 3) Evidence availability reduction: the worse the probe visibility, the richness of the catchable content, and the proportion of encrypted tunnels of a node in the prediction path, the greater the evidence availability reduction.

[0067] 4) Historical consistency and risk context: if the prediction path is similar to the path pattern commonly used by the same origin attacker in history, the deviation degree will be appropriately reduced; if the path contains high-risk or hidden nodes that have been marked, the deviation degree will be increased.

[0068] As a specific example, the deviation degree is calculated as follows:

[0069] 1) Standardize the scores of sequence deviation, node missing and bypass penalty, evidence availability reduction, and historical consistency and risk context to 0-1 respectively;

[0070] 2) Sequence deviation score = number of mislocated monitoring points x 0.1 + average number of hops of mislocated monitoring points x 0.05;

[0071] 3) Missing and bypass penalty score = number of missing monitoring points x 0.15 + number of bypass hops x 0.02;

[0072] 4) Evidence availability reduction score = (1 - probe visibility) x 0.4 + encrypted tunnel proportion x 0.3 + log integrity missing proportion x 0.3;

[0073] 5) Historical consistency and risk context score = (1 - similarity of same origin events) x 0.5 + proportion of overlapping hidden nodes x 0.5;

[0074] 6) Deviation = 0.3 x Sequential Deviation Score + 0.25 x Missing and Loop Penalty Score + 0.25 x Forensics Availability Reduction Score + 0.2 x Historical Consistency and Risk Context Score; the smaller the deviation score, the better the path. Further, the step S4 further comprises:

[0075] Step S5, if the two opposite direction tracing prediction paths cannot be successfully planned, directly reverse trace along the path opposite to the current analysis direction.

[0076] In a preferred embodiment, the embodiment is deployed in a honeynet environment of an industrial control network of an energy enterprise. The honeynet system pre-defines an attack navigation path, the nodes of which are in turn: external Internet access area → external network DMZ area decoy VPN server → simulation application server group → virtualized SCADA control station → simulated PLC terminal → core energy scheduling database.

[0077] When the honeynet system detects that a brute force cracking attempt is initiated from the public network IP 203.56.x.x to the decoy VPN server, accompanied by a Modbus port scan of the simulation SCADA station, an attack luring analysis path is dynamically generated: 203.56.x.x → decoy VPN → simulation SCADA station → virtual PLC.

[0078] Step S1 is performed, dynamic matching and screening are performed:

[0079] S11, mark the candidate nodes: map the nodes on the attack luring analysis path with the attack navigation path.

[0080] Decoy VPN: has been accessed, the event type (brute force cracking) meets the tracing strategy, has complete forensics image (high forensics availability), is marked as a candidate, and is set as node 1.

[0081] Simulation application server group: not accessed, not marked, set as node 2.

[0082] Simulation SCADA station: has been accessed, the event type (port scan) meets the tracing strategy, has traffic record capability, is marked as a candidate, and is set as node 3.

[0083] Virtual PLC: has been accessed (received scan probe), has log record capability, is marked as a candidate, and is set as node 4.

[0084] Core scheduling database: not accessed, not marked, set as node 5.

[0085] S12, Forming a set: The three candidate nodes are all connected with the previous and next nodes to form an effective link (hop count ≤ 3, continuous event stream). Arrange them in the order in the attack navigation path to form a candidate node set: [node 1: decoy VPN, node 3: simulated SCADA station, node 4: virtual PLC].

[0086] Step S2 is performed:

[0087] The preset traceability judgment threshold is 5 hops (based on the median distance in the historical link).

[0088] The network path distance of each candidate node to the current attack behavior occurrence position (203.56.x.x) is calculated:

[0089] The distance of node 1 (decoy VPN) is 3 hops, and the absolute value of the difference of node 1 is: |3-5|=2;

[0090] The distance of node 3 (simulated SCADA station) is 6 hops, and the absolute value of the difference of node 3 is: |6-5|=1;

[0091] The distance of node 4 (virtual PLC) is 8 hops, and the absolute value of the difference of node 4 is: |8-5|=3;

[0092] S21-S22: Select the node with the smallest absolute value of the difference, that is, node 3 (simulated SCADA station) as the optimal traceability node.

[0093] Step S3 is performed:

[0094] The link from the current attack behavior occurrence position (203.56.x.x) to the simulated SCADA station is analyzed:

[0095] S31, Obtain features: find a one-hop 18.x.x.x in the path.

[0096] Intelligence attribution feature: the IP belongs to a well-known public cloud ASN (Amazon AWS).

[0097] Protocol fingerprint feature: its TLS certificate is reused for a short time in multiple unrelated sessions, and the HTTP message finds the CONNECT method.

[0098] Topology timing feature: the IP carries traffic from more than 50 different source IPs within 5 minutes.

[0099] S32, Calculate the score: calculate the anonymity score according to the weight (intelligence 0.4, protocol 0.35, topology 0.25).

[0100] Intelligence score: 85 (cloud environment, high anonymity possibility);

[0101] Protocol score: 78 (TLS multiplexing + CONNECT method);

[0102] Topology score: 88 (high session aggregation);

[0103] Anonymity score = 0.4*85 + 0.35*78 + 0.25*88 = 84.1;

[0104] S33, decision: anonymity score 84.1> label threshold 80, determine that there is an anonymous jump node. Therefore, it is determined that the current tracing is not completed, and step S4 is continued.

[0105] Step S4 is executed:

[0106] The preset monitoring time window is 10 minutes.

[0107] The activity fluctuation threshold is half of the average number of hops (5 hops in this embodiment) plus 1, i.e. 3.5 hops, rounded to the last 4 hops, i.e. in this embodiment, the activity fluctuation threshold is dynamically set to 4 hops based on the average number of hops between honeypot key nodes.

[0108] Statistical window attack source position change:

[0109] T0: ASN64512, 8 hops away from SCADA;

[0110] T0+3min: ASN64513, 5 hops away from SCADA (cross ASN, hop difference 3, weighted 3*1.5=4.5);

[0111] T0+7min: ASN64514, 9 hops away from SCADA (cross ASN, hop difference 4, weighted 4*1.5=6);

[0112] Calculate the total change: 4.5+6=10.5 hops.

[0113] Comparison: total change 10.5> activity fluctuation threshold 4.

[0114] Decision: Since the change is greater than the threshold, the system plans two opposite direction tracing prediction paths for comparison and analysis.

[0115] Forward path: attack source -> core scheduling database;

[0116] Reverse path: attack source -> upstream control end;

[0117] After planning the path, the subsequent steps are executed:

[0118] The deviation degree is calculated: the deviation degree of the forward path and the reverse path from the attack navigation path is calculated respectively (weighted calculation based on factors such as sequence deviation, node missing, and evidence reduction). The deviation degree of the forward path is 0.32, and the deviation degree of the reverse path is 0.68.

[0119] Select direction: select the forward path direction with smaller deviation degree as the new current analysis direction.

[0120] The system attempts to perform forward path tracking. However, it is found that the "virtual PLC to scheduling database" segment is blocked by an encrypted tunnel, and the next two hops are not visible, so it is determined that the forward path is not feasible.

[0121] At this time, step S5 is performed: in response to the inability to plan a forward path, directly perform reverse tracking along the reverse path to avoid tracing interruption. The system immediately switches the analysis direction to the reverse direction and traces upstream of the attack source 203.56.x.x.

[0122] In this embodiment, the activity fluctuation threshold and the tracing determination threshold are not fixed.

[0123] The activity fluctuation threshold is updated every 12 hours according to the average number of hops between key nodes collected in the latest period.

[0124] The tracing determination threshold is dynamically adjusted every 24 hours in combination with the median of the optimal distance in recent successful tracing cases.

[0125] In this example, after the reverse tracking starts, the system recalculates the activity fluctuation threshold based on the current network state and still takes 5 hops as the basis for subsequent analysis.

[0126] Through the above steps of this embodiment, the problems of tracing interruption, inaccurate positioning, and ignoring hidden nodes that occur when traditional methods face advanced persistent threats (APTs) that use cloud agents to hide their tracks and frequently change their source locations are successfully solved. Finally, through reverse tracking, the system successfully locates the real control end (C2 Server) of the attacker located in a data center overseas, and generates a complete visual attack chain evidence package.

[0127] Please refer to Figure 2 , which shows the structure diagram of an attack behavior tracing system in a honeynet environment of the present application.

[0128] As shown in Figure 2 , the attack event node screening module 200, the distance evaluation and optimal node selection module 201, the hidden jump identification module 202, and the direction and predicted path planning module 203.

[0129] Among them, the attack event node filtering module 200 is configured to dynamically match the real-time generated attack trapping analysis path with the predefined attack navigation path when an attack behavior is detected in the honey garden environment, and filter out a set of candidate nodes that meet the source tracing judgment conditions from the attack navigation path.

[0130] The distance assessment and optimal node selection module 201 is configured to calculate the network path distance between each node in the candidate node set and the location where the current attack occurred, and determine an optimal source tracing node from the candidate node set based on the degree of closeness of the network path distance to a preset source tracing judgment threshold.

[0131] The concealed jump identification module 202 is configured to determine whether there is a concealed jump node on the network link between the optimal tracing node and the location where the current attack behavior occurs; if it exists, it is determined that the tracing of the current attack behavior is not completed, and the direction and predicted path planning module 203 is called to perform subsequent analysis; if it does not exist, it is determined that the tracing of the current attack behavior is completed.

[0132] The direction and prediction path planning module 203 is configured to statistically analyze the change in the location of the attack behavior within a preset monitoring time window and compare the change with an activity fluctuation threshold. If the change is greater than the activity fluctuation threshold, two source tracing prediction paths in opposite directions are planned for comparative analysis. If the change is not greater than the activity fluctuation threshold, the source tracing analysis direction is switched to the opposite direction of the current analysis direction for reverse tracing. Furthermore, the direction and prediction path planning module is further configured to: respond to the inability to successfully plan the two source tracing prediction paths in opposite directions, directly perform reverse tracing along the path opposite to the current analysis direction.

[0133] It should be understood that Figure 2 The modules and references described in the document Figure 1 The steps described in the text correspond to those in the method described above. Therefore, the operations, features, and corresponding technical effects described above also apply to the method described in the text. Figure 2 The various modules in the document will not be described in detail here.

[0134] In other embodiments, the present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein when the program instructions are executed by a processor, the processor performs an attack behavior tracing method in a honeycomb environment according to any of the above method embodiments.

[0135] In one embodiment, the computer-readable storage medium of the present invention stores computer-executable instructions, which are configured as follows:

[0136] S1, when an attack behavior is detected in the honeynet environment, dynamically matching an attack-luring analysis path generated in real time with a pre-defined attack navigation path, and screening a candidate node set meeting a traceability judgment condition from the attack navigation path;

[0137] S2, calculating a network path distance between each node in the candidate node set and a current attack behavior occurrence position, and determining an optimal traceability node from the candidate node set based on a closeness of the network path distance to a pre-set traceability judgment threshold value;

[0138] S3, judging whether there is a hidden jump node on a network link between the optimal traceability node and the current attack behavior occurrence position;

[0139] If there is, it is determined that the current attack behavior traceability is not completed, and step S4 is executed;

[0140] If there is not, it is determined that the current attack behavior traceability is completed;

[0141] S4, counting a change amount of the attack behavior occurrence position in a pre-set monitoring time window, and comparing the change amount with an activity fluctuation threshold value;

[0142] If the change amount is greater than the activity fluctuation threshold value, planning two traceability prediction paths in opposite directions for comparison and analysis;

[0143] If the change amount is not greater than the activity fluctuation threshold value, controlling a traceability analysis direction to switch to a direction opposite to a current analysis direction for reverse tracking.

[0144] The computer readable storage medium can include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required by a function; the data storage area can store data created according to the use of the attack behavior traceability system in a honeynet environment, etc. In addition, the computer readable storage medium can include a high-speed random access memory, and can also include a memory such as at least one disk storage device, a flash memory device, or other non-volatile solid-state memory device. In some embodiments, the computer readable storage medium can optionally include a memory remotely arranged relative to the processor, and these remote memories can be connected to the attack behavior traceability system in a honeynet environment through a network. Examples of the above network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0145] Figure 3 is a structural schematic diagram of an electronic device provided by an embodiment of the application, as Figure 3As shown, the device includes a processor 310 and a memory 320. The electronic device can also include an input device 330 and an output device 340. The processor 310, the memory 320, the input device 330 and the output device 340 can be connected by a bus or other means, Figure 3 The memory 320 is the computer readable storage medium described above. The processor 310 performs various functional applications and data processing of the server by running the non-volatile software programs, instructions and modules stored in the memory 320, that is, implements the attack behavior tracing method in a honeynet environment according to the method embodiment described above. The input device 330 can receive input digital or character information, and generate key signal input related to user settings and function control of the attack behavior tracing system in a honeynet environment. The output device 340 can include a display device such as a display screen.

[0146] The electronic device described above can perform the method provided by the embodiments of the present application, and has the corresponding function modules and beneficial effects of the execution method. Technical details not described in detail in the present embodiment can be referred to the method provided by the embodiments of the present application.

[0147] As an implementation, the electronic device described above is applied to an attack behavior tracing system in a honeynet environment, and is used for a client, including: at least one processor; and a memory in communication connection with the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to:

[0148] S1, when detecting an attack behavior in a honeynet environment, dynamically matching an attack luring analysis path generated in real time with a pre-defined attack navigation path, and screening a candidate node set meeting a tracing judgment condition from the attack navigation path;

[0149] S2, calculating a network path distance between each node in the candidate node set and a current attack behavior occurrence position, and determining an optimal tracing node from the candidate node set based on the proximity of the network path distance to a preset tracing judgment threshold value;

[0150] S3, judging whether there is a hidden jump node on a network link between the optimal tracing node and the current attack behavior occurrence position;

[0151] If there is, it is determined that the current attack behavior tracing is not completed, and step S4 is performed;

[0152] If there is not, it is determined that the current attack behavior tracing is completed;

[0153] S4, statistics a change amount of the attack behavior occurrence position in a preset monitoring time window, and compare the change amount with an activity fluctuation threshold;

[0154] If the change amount is greater than the activity fluctuation threshold, two opposite direction tracing prediction paths are planned for comparison and analysis;

[0155] If the change amount is not greater than the activity fluctuation threshold, the tracing analysis direction is switched to the opposite direction of the current analysis direction for reverse tracking.

[0156] Through the above description of the embodiments, those skilled in the art can clearly understand that the embodiments can be realized by means of software plus necessary universal hardware platforms, and of course, can also be realized by hardware. Based on such understanding, the above technical solutions, essentially or in other words, the part of the prior art that makes a contribution, can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, etc., and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of the various embodiments or some parts of the embodiments.

[0157] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for some technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. An attack behavior tracing method in a honeycomb environment, characterized in that, The method comprises the following steps: S1, when an attack behavior is detected in a honeycomb environment, dynamically matching an attack-luring analysis path generated in real time with a pre-defined attack navigation path, and screening a candidate node set meeting a traceability judgment condition from the attack navigation path; S2, calculating a network path distance between each node in the candidate node set and a current attack behavior occurrence position, and determining an optimal traceability node from the candidate node set based on a closeness of the network path distance to a pre-set traceability judgment threshold value; S3, judging whether there is a hidden jump node on a network link between the optimal traceability node and the current attack behavior occurrence position; if there is, determining that the current attack behavior traceability is not completed, and performing step S4; if there is not, determining that the current attack behavior traceability is completed; S4, counting a change amount of the attack behavior occurrence position within a pre-set monitoring time window, and comparing the change amount with an activity fluctuation threshold value; if the change amount is greater than the activity fluctuation threshold value, planning two opposite traceability prediction paths for comparison and analysis; if the change amount is not greater than the activity fluctuation threshold value, controlling a traceability analysis direction to switch to a reverse tracking in a direction opposite to a current analysis direction.

2. The method of claim 1, wherein, The step S1 of screening the candidate node set meeting the traceability judgment condition from the attack navigation path comprises: S11, marking each node meeting the traceability judgment condition as a candidate traceability node, wherein the traceability judgment condition is that the node has been accessed by the attack-luring analysis path, the event type meets a traceability strategy, and the node has a monitoring and evidence collection capability in the pre-set path; S12, after eliminating isolated nodes not forming effective links from all the candidate nodes, arranging the remaining candidate nodes in an order of the remaining candidate nodes in the attack navigation path to form the candidate node set.

3. The method of claim 1, wherein, The step S2 of determining the optimal traceability node from the candidate node set comprises: S21, calculating an absolute value of a difference between the network path distance of each node and the traceability judgment threshold value; S22, selecting a node with the smallest absolute value of the difference as the optimal traceability node.

4. The method of claim 1, wherein, The step S3 of judging whether there is the hidden jump node on the network link between the optimal traceability node and the current attack behavior occurrence position comprises: S31, obtaining feature information of each hop on the network link, wherein the feature information comprises intelligence attribution features, protocol fingerprint features, and topology timing features; S32, calculating hidden scores of each hop through a weighted scoring model based on the feature information; S33, if the hidden score of any hop exceeds a marking threshold value, determining that the hidden jump node exists.

5. The method of claim 1, wherein, The step S4 further comprises: S5, if the two opposite traceability prediction paths cannot be successfully planned, directly performing the reverse tracking along a path opposite to the current analysis direction.

6. The method of claim 1, wherein, The activity fluctuation threshold value in the step S4 is dynamically set based on an average network hop number between key nodes in the honeycomb environment.

7. The method of claim 1, wherein, The step S4 of planning two opposite-direction tracing prediction paths further comprises: calculating a deviation degree of each of the tracing prediction paths from the attack navigation path; selecting, based on the deviation degree, a direction corresponding to a path with a smaller deviation degree as a new current analysis direction from the two paths; wherein the deviation degree is calculated based on a sequence deviation of key monitoring points in the path, a missing and detour penalty, a forensics reducibility reduction, historical consistency, and risk context.

8. An attack behavior tracing system in a honeycomb environment, characterized in that, comprise: an attack event node screening module, a distance evaluation and optimal node selection module, a hidden jump identification module, and a direction and prediction path planning module; the attack event node screening module is configured to, when an attack behavior is detected in the honeynet environment, dynamically match an attack luring analysis path generated in real time with a pre-defined attack navigation path, and screen a candidate node set satisfying a tracing determination condition from the attack navigation path; the distance evaluation and optimal node selection module is configured to calculate a network path distance between each node in the candidate node set and a current attack behavior occurrence position, and determine an optimal tracing node from the candidate node set based on a closeness of the network path distance to a pre-set tracing determination threshold value; the hidden jump identification module is configured to judge whether there is a hidden jump node on a network link between the optimal tracing node and the current attack behavior occurrence position; if there is, it is determined that the current attack behavior tracing is not completed, and the direction and prediction path planning module is called to perform subsequent analysis; if there is not, it is determined that the current attack behavior tracing is completed; the direction and prediction path planning module is configured to calculate a change amount of the attack behavior occurrence position within a pre-set monitoring time window, and compare the change amount with an activity fluctuation threshold value; if the change amount is greater than the activity fluctuation threshold value, two opposite-direction tracing prediction paths are planned for comparison analysis; if the change amount is not greater than the activity fluctuation threshold value, the tracing analysis direction is switched to the opposite direction of the current analysis direction for reverse tracking; and the direction and prediction path planning module is further configured to, in response to being unable to successfully plan the two opposite-direction tracing prediction paths, directly perform reverse tracking along a path opposite to the current analysis direction.

9. An electronic device, comprising: comprise: at least one processor, and a memory connected to the at least one processor in communication, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1 to 7.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The program is executed by the processor to implement the method of any one of claims 1 to 7.

Images