Method and system for analyzing lateral movement attack paths based on virtualization luring network

Abstract

This application relates to the field of honeypot decoy network technology, and particularly to a method and system for analyzing lateral movement attack paths based on virtualized decoy networks. The method includes periodically collecting system logs from N network nodes in a virtualized decoy network, where each network node deploys a honeypot server, and N is an integer greater than or equal to 1; updating the constructed attack path based on the correlation between the system log of the Nth network node and the constructed attack path; and traversing the system logs of the N network nodes until the system logs collected in the current period are processed. This application integrates all log data from all nodes in the virtualized decoy network to establish a complete and comprehensive attack graph, thereby achieving comprehensive analysis of attackers' cross-system and cross-device behaviors, improving the depth and accuracy of existing analyses.

Description

Technical Field

[0001] This application relates to the field of honeypot decoy network technology, and in particular to a method and system for analyzing lateral movement attack paths based on virtualized decoy networks. Background Technology

[0002] Virtualized decoy networks are host systems built by integrating multiple honeypot services and interconnecting these hosts into a virtual network environment using networking technology. Each service node in a virtualized decoy network is implemented using honeypot technology, effectively simulating a real network environment and making it difficult for attackers to identify its disguised nature. Once an attacker infiltrates the virtual network, all their actions, attack paths, and interaction data are monitored and recorded throughout, providing complete attack chain evidence for security analysis.

[0003] In complex network environments, attackers typically move laterally between multiple nodes, but a single honeypot or traditional honeynet cannot effectively record these cross-node activities, leading to the loss of crucial information. This also makes it impossible to identify the attacker's hopping between various devices throughout the network, and to establish a complete trail of attacker behavior.

[0004] Therefore, in order to record the attack path of lateral movement attackers, this application provides a lateral movement attack path analysis method based on a virtualized decoy network, and a honeypot defense system based on a virtualized decoy network. Summary of the Invention

[0005] To overcome the problems existing in related technologies, the first aspect of this application provides a method for analyzing lateral movement attack paths based on virtualized decoy networks, including: System logs of N network nodes in a virtualized trapping network are collected periodically. Each network node in the virtualized trapping network is equipped with a honeypot server, and N is an integer greater than or equal to 1. The constructed attack path is updated based on the correlation between the system log of the Nth network node and the constructed attack path; Iterate through the system logs of N network nodes until the system logs collected in the current period are processed.

[0006] In one implementation, updating the constructed attack path based on the correlation between the system log of the Nth network node and the constructed attack path specifically includes: Each system log entry is treated as a node in the attack graph. The correlation between logs is identified, and the log nodes are connected in timestamp order based on the correlation of the attack logs to establish connections between the attack logs and update the constructed attack path.

[0007] In one implementation, identifying the correlation between logs specifically includes: Analyze whether the nodes are connected; Determine whether the attack behavior in different nodes belongs to the same attacker.

[0008] In one implementation, before updating the constructed attack path based on the correlation between the system log of the Nth network node and the constructed attack path, the method further includes: The collected system logs are processed and encoded into 5-tuple data, which includes the source IP, source port, timestamp, destination IP, and destination port.

[0009] In one implementation, before processing the collected system logs, the method further includes: Clean the collected system logs and correct any data with incorrect formats.

[0010] In one implementation, the periodic collection of system logs from N network nodes in the virtualized trapping network specifically includes: The collected system logs are stored in a cache and written to the database every ten seconds. A second aspect of this application provides a honeypot defense system based on a virtualized decoy network, including a log collection module and an attack path construction module. The log collection module is used to periodically collect system logs from N network nodes in the virtualized trapping network; The attack path construction module is used to update the constructed attack path based on the correlation between the system log of the Nth network node and the constructed attack path.

[0011] In one embodiment, the honeypot defense system further includes a data processing module; the data processing module is used to process the collected system logs.

[0012] The technical solution provided in this application may include the following beneficial effects: 1) Improve attack identification efficiency Current technologies can only detect lateral movement within a network or draw a complete attack graph for a single node, but they cannot connect the attack graphs before and after the attacker's lateral movement to form a complete attack trajectory graph of the attacker across the entire network. By constructing a complete attack graph, security teams can quickly identify attacker behavior patterns and movement paths, improving the efficiency of attack identification.

[0013] 2) Improve the depth and accuracy of analysis Existing technologies only focus on generating attack graphs from log data in a single node, neglecting the behavioral correlations of attackers jumping between different nodes. This limits the depth and accuracy of attack graph analysis and prevents a comprehensive analysis of attacker behavior patterns. This invention integrates all log data from all nodes in a virtualized trapping network to establish a complete and comprehensive attack graph, thereby enabling a comprehensive analysis of attacker behavior across systems and devices, improving the depth and accuracy of existing analyses.

[0014] 3) Support comprehensive security decisions Visualized attack graphs and dynamic analysis results provide security teams with an intuitive data foundation, helping them quickly identify and understand attacker behavior patterns and their potential impact. The graph database offers query capabilities to view a complete attack graph for a specific attacker, simplifying complex attack paths. This allows security teams to more easily grasp the attacker's behavioral trajectory and relationships within the network, thereby effectively assessing the current security posture. The dynamic analysis function updates the attack graph in real time, reflecting the latest attack behaviors and changes, ensuring that decisions are based on the most up-to-date data. This enables security teams to develop more precise security and response strategies, significantly increasing their ability and efficiency in dealing with complex threats.

[0015] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0016] The above and other objects, features and advantages of this application will become more apparent from the more detailed description of exemplary embodiments thereof in conjunction with the accompanying drawings, wherein the same reference numerals generally represent the same components in the exemplary embodiments thereof.

[0017] Figure 1 This is a flowchart illustrating the lateral movement attack path analysis method according to an embodiment of this application; Figure 2 This is an interactive schematic diagram of the lateral movement attack path analysis method shown in the embodiments of this application. Detailed Implementation

[0018] Preferred embodiments of the present application will now be described in more detail with reference to the accompanying drawings. While preferred embodiments of the present application are shown in the drawings, it should be understood that the present application may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided to make the present application more thorough and complete, and to fully convey the scope of the present application to those skilled in the art.

[0019] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.

[0020] It should be understood that although the terms "first," "second," "third," etc., may be used in this application to describe various information, this information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, "multiple" means two or more, unless otherwise explicitly specified.

[0021] Traditional honeynets cannot effectively record the attack paths of lateral movement attackers. This application provides a method for analyzing lateral movement attack paths based on virtualized decoy networks. It can collect system logs and construct attack paths based on the correlation between system logs, which facilitates analysis by network defenders.

[0022] The following combination Figure 1 and Figure 2 The lateral movement attack path analysis method provided in the embodiments of this application will be described in detail.

[0023] Figure 1 This is a flowchart illustrating the lateral movement attack path analysis method according to an embodiment of this application.

[0024] Figure 2 This is an interactive schematic diagram of the lateral movement attack path analysis method shown in the embodiments of this application.

[0025] In step 101, system logs of N network nodes in the virtualized trap network are collected periodically.

[0026] Specifically, each network node in the virtualized trapping network is equipped with a honeypot server. It is understood that N is an integer greater than or equal to 1.

[0027] Furthermore, the collected system logs are stored in a cache and written to the database every ten seconds.

[0028] Before step 102, the following is also included: 201. Clean the collected system logs and correct any data with incorrect formats.

[0029] 202. Process the collected system logs and encode them into 5-tuple data, which includes the source IP, source port, timestamp, destination IP, and destination port.

[0030] In step 201, data cleaning involves processing the acquired data, removing noise and irrelevant information, removing incomplete records to ensure the accuracy of the analysis data, correcting erroneous logs including timestamps, IP addresses, and ports, and converting the data to a unified format, including unified timestamp format and encoding conversion, to facilitate subsequent data processing and analysis.

[0031] In step 2012, data feature extraction involves normalizing and standardizing the processed data, transforming it into a 5-tuple format (source IP, source port, timestamp, etc.). This improves data consistency and readability, facilitating subsequent data analysis and visualization.

[0032] In step 102, the constructed attack path is updated based on the correlation between the system log of the Nth network node and the constructed attack path.

[0033] Specifically, each system log is treated as a node in the attack path. The correlation between logs is identified, and the log nodes are connected in timestamp order based on the correlation of the system logs to establish the connection between the system logs and update the constructed attack path.

[0034] The identification of correlations between system logs specifically includes: Analyze whether the nodes are connected; Determine whether the attack behavior in different nodes belongs to the same attacker.

[0035] Specifically, the processed log data is analyzed, and the correlation between each log entry is analyzed using session ID, IP address, and port number to determine whether the nodes are connected.

[0036] in, It represents a node and nodes Whether it is located in the attack graph constructed by the same attacker in the same attack behavior, wherein the attack graph is a pre-constructed knowledge graph.

[0037] If a redirection occurs in the current system log, determine whether the attack behaviors on different nodes belong to the same attacker. S(A,B) represents the correlation between attack behaviors A and B:

[0038] Where A represents attack behaviors within the established attack path, and B represents attack behaviors currently recorded in the system logs. The same attack action is included in both attack behaviors A and B. This represents the total number of different attack actions for attack behaviors A and B. It is a correlation function that calculates the correlation between A and B, representing the degree of correlation between the attack actions of A and B.

[0039] If the correlation exceeds a preset correlation threshold, the constructed attack path is updated using the current system log timestamps, thus drawing a complete attack trajectory graph. This attack graph not only displays each step of the attacker's operation but also shows the attacker's behavioral trajectory as they jump between nodes, helping the security team to deeply understand the attacker's activity patterns. Furthermore, when timestamps are the same, connections are made based on the order in which Kafka messages are received.

[0040] For example, in the following two incomplete log entries, the original IP and port of 192.168.200.30:58950 show a redirection: from 192.168.200.30:58950 to 127.0.0.1:34258. This matches the original IP and port in the first log entry. Checking the timestamp information, it can be concluded that the attacker reached the first log entry's node through the node containing the second log entry, indicating a connection between the two nodes. Each time a new attack log is received, it checks for the existence of a preceding node (a preceding node represents the last node in an attack chain where the attacker has not yet exited the attack). If a preceding node exists, the log entry is added to the previous attack chain; if no preceding node exists, it indicates a new attack, and a new attack path is generated using this attack as the root node.

[0041] "properties": {"src_ip": "127.0.0.1", "src_port": "34258", "extra": "{'eventid': 'redishoneypot.connect', 'msg': '', 'action': 'NewConnect', 'level': 'info'}", "dst_port": "6380", "dst_ip": "127.0.0.1", "timestamp": "1718351654"} "properties": {"src_ip": "192.168.200.30", "src_port": "58950", "extra": "{'command': 'cli_command', 'dst_ip': '127.0.0.1', 'timestamp': '2024-06-14T07:54:14.18Z', 'action': 'command', 'pid': '213', 'connections':[{'info': [{'laddr': {'port': 34258, 'ip': '127.0.0.1'}, 'raddr': {'port':6380, 'ip': '127.0.0.1'}}], 'pid': 230}], 'src_port': '44740', 'dst_port': '22', 'src_ip': '127.0.0.1', 'session_id': '04b4c6fd-4b3a-4a94-8752-88659a3ca564', 'user': 'zhangsan'}", "dst_port": "2200", "dst_ip": "192.168.200.31", "timestamp": "1718351654"} In step 103, the system logs of N network nodes are traversed until the system logs collected in the current period are processed.

[0042] Based on the lateral movement attack path analysis method described above, this application embodiment also provides a honeypot defense system based on a virtualized trapping network, including a log collection module, an attack path construction module, and a data processing module. The log collection module is used to periodically collect system logs from N network nodes in the virtualized trapping network; The attack path construction module is used to update the constructed attack path based on the correlation between the system log of the Nth network node and the constructed attack path.

[0043] The data processing module is used to process the collected system logs.

[0044] The solution of this application has been described in detail above with reference to the accompanying drawings. In the above embodiments, the descriptions of each embodiment have different emphases; parts not described in detail in a certain embodiment can be referred to in the relevant descriptions of other embodiments. Those skilled in the art should also understand that the actions and modules involved in the specification are not necessarily essential to this application. Furthermore, it is understood that the steps in the method of this application embodiment can be adjusted, combined, and deleted according to actual needs, and the modules in the device of this application embodiment can be combined, divided, and deleted according to actual needs.

[0045] Furthermore, the method according to this application can also be implemented as a computer program or computer program product, which includes computer program code instructions for performing some or all of the steps in the method described above.

[0046] Alternatively, this application may be implemented as a non-transitory machine-readable storage medium (or computer-readable storage medium, or machine-readable storage medium) storing executable code (or computer program, or computer instruction code) thereon, which, when executed by a processor of an electronic device (or electronic device, server, etc.), causes the processor to perform part or all of the steps of the methods described above according to this application.

[0047] Those skilled in the art will also understand that the various exemplary logic blocks, modules, circuits, and algorithm steps described in connection with the present application can be implemented as electronic hardware, computer software, or a combination of both.

[0048] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems and methods according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0049] The various embodiments of this application have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or improvement of the technology in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A method for analyzing lateral movement attack paths based on virtualized decoy networks, characterized in that, include: System logs of N network nodes in a virtualized trapping network are collected periodically. Each network node in the virtualized trapping network is equipped with a honeypot server, and N is an integer greater than or equal to 1. The constructed attack path is updated based on the correlation between the system log of the nth network node and the constructed attack path; The nth network node is one of the N network nodes; Iterate through the system logs of N network nodes until the system logs collected in the current period are processed. The step of updating the constructed attack path based on the correlation between the system log of the nth network node and the constructed attack path specifically includes: Each system log entry is treated as a node in the attack graph. The correlation between logs is identified, and the log nodes are connected in chronological order according to their timestamps to establish connections between the attack logs and update the constructed attack path. The identification of correlations between logs specifically includes: Analyze whether the nodes are connected; Determine whether the attack behavior in different nodes belongs to the same attacker; The processed log data is analyzed by examining the correlation between log entries using session ID, IP address, and port number, and by determining whether the nodes are interconnected. in, It represents a node and nodes Whether it is located in the attack graph constructed by the same attacker in the same attack behavior, wherein the attack graph is a pre-constructed knowledge graph; If a redirection occurs in the current system log, determine whether the attack behaviors on different nodes belong to the same attacker. S(A,B) represents the correlation between attack behaviors A and B: Where A represents attack behaviors within the established attack path, and B represents attack behaviors currently recorded in the system logs. The same attack action is included in both attack behaviors A and B. This represents the total number of different attack actions for attack behaviors A and B. It is a correlation function that calculates the correlation between A and B, representing the degree of correlation between the attack actions of A and B; If the correlation is greater than the preset correlation threshold, the constructed attack path is updated by the timestamp of the current system log, thereby drawing a complete trajectory map of the attacker. This complete trajectory map of the attacker not only shows each step of the attacker's operation, but also shows the attacker's behavioral trajectory of jumping between nodes, helping the security team to deeply understand the attacker's activity patterns. Furthermore, when the timestamps are the same, they will be connected according to the order in which the information is received by Kafka.

2. The lateral movement attack path analysis method according to claim 1, characterized in that, Before updating the constructed attack path based on the correlation between the system log of the nth network node and the constructed attack path, the method further includes: The collected system logs are processed and encoded into 5-tuple data, which includes the source IP, source port, timestamp, destination IP, and destination port.

3. The lateral movement attack path analysis method according to claim 2, characterized in that, Before processing the collected system logs, the process also includes: Clean the collected system logs and correct any data with incorrect formats.

4. The lateral movement attack path analysis method according to claim 2, characterized in that, The periodic collection of system logs from N network nodes in the virtualized trapping network specifically includes: The collected system logs are stored in a cache and written to the database every ten seconds.

5. A honeypot defense system based on a virtualized decoy network, characterized in that, The lateral movement attack path analysis method according to any one of claims 1-4 includes a log collection module and an attack path construction module; The log collection module is used to periodically collect system logs from N network nodes in the virtualized trapping network; The attack path construction module is used to update the constructed attack path based on the correlation between the system log of the nth network node and the constructed attack path.

6. A honeypot defense system based on a virtualized decoy network according to claim 5, characterized in that, It also includes a data processing module; The data processing module is used to process the collected system logs.

Images