Dynamic defense method and device for expanding honeypot mapping point

Abstract

The invention provides a dynamic defense method and device for expanding honeypot mapping points, and relates to the technical field of network security. The method comprises the following steps: in response to a received access request sent by an access end, determining a service type represented by traffic information of the access end; and under the condition that the service type represented by the flow information is an attack behavior flow, determining a virtual address represented by the flow information according to a deployed flow table topology corresponding to the change period and a target identifier represented by the flow information, so that the flow information is transmitted to the virtual address, and an alarm semantic signal is generated.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and more particularly, to a dynamic defense method and device for extending a honeypot mapping point. BACKGROUND

[0002] In the current network security field, the defense against server assets mainly relies on three types of technologies. The first type is traditional honeypot technology, which deploys a honeypot server with a fixed IP to simulate business to attract attacks. However, because the IP does not change for a long time, it is easy to be recognized as a honeypot by an attacker through "port scanning + traffic feature analysis", and the defense effect is limited. The second type is SDN dynamic IP technology, which modifies the IP through an SDN flow table to protect the real business IP. However, it is only directed at real assets and does not combine with honeypots. After the attacker bypasses the real IP, there is no trap to intercept, and the attack behavior cannot be captured. The third type is NAT address conversion technology, which realizes IP hiding. However, it can only statically bind the IP mapping relationship and cannot dynamically change the period. Moreover, it cannot link with defense rules and cannot cope with targeted scanning attacks. SUMMARY

[0003] Therefore, the present application provides a dynamic defense method and device for extending a honeypot mapping point.

[0004] One aspect of the present application provides a dynamic defense method for extending a honeypot mapping point, comprising: determining a business type represented by traffic information of an access end in response to an access request sent by the access end; in the case that the business type represented by the traffic information is an attack behavior flow, determining a virtual address represented by the traffic information according to a flow table topology deployed corresponding to a change period and a destination identifier represented by the traffic information, so that the traffic information is transmitted to the virtual address, and an alarm semantic signal is generated.

[0005] According to the embodiments of the present application, in the case that the business type represented by the traffic information is a legal business flow, a real identifier represented by the traffic information is determined according to a flow table topology deployed corresponding to a change period and a destination identifier represented by the traffic information, so that the traffic information is transmitted to a network address represented by the real identifier.

[0006] According to the embodiments of the present application, the method further comprises: determining a destination identifier represented by a data packet fed back by a back end according to a real identifier represented by the data packet fed back by the back end and a flow table topology deployed corresponding to the change period, so that the data packet is transmitted to a network address represented by the destination identifier.

[0007] According to the embodiments of the present application, the method for determining the deployed flow table topology corresponding to the change period comprises: completing global topology perception of the backend resource pool by the multi-dimensional asset probe, and determining the network identifier of the real service node; for each change period, constructing a heterogeneous virtual network address mapping pool corresponding to each change period according to the first mapping relationship between the network address represented by the real identifier corresponding to the network identifier represented by the real service node and the network address represented by the destination identifier and the second mapping relationship between the network address represented by the destination identifier corresponding to the network identifier represented by the non-real service node and the virtual address; converting the heterogeneous virtual network address mapping pool into executable flow table topology instructions, and executing the flow table topology instructions to obtain the deployed flow table topology corresponding to the change period.

[0008] According to the embodiments of the present application, the characteristics of the normal service traffic are taken as the reference to determine the service type represented by the traffic information of the access end.

[0009] According to the embodiments of the present application, the method for determining the characteristics of the normal service traffic comprises: based on machine learning, extracting the characteristics of the historical service traffic of the backend resource pool to obtain the characteristics of the normal service traffic.

[0010] According to the embodiments of the present application, the method further comprises: performing semantic log archiving on the traffic information transmitted to the virtual address.

[0011] According to the embodiments of the present application, the method further comprises: performing attack tracing on the traffic information transmitted to the virtual address.

[0012] According to the embodiments of the present application, after converting the heterogeneous virtual network address mapping pool into executable flow table topology instructions, the method further comprises: performing flow table semantic legality verification on the flow table topology represented by the flow table topology instructions; and updating the flow table topology instructions by applying the flow table topology instructions that pass the verification.

[0013] Another aspect of the present application provides a dynamic defense device for extending the honeypot mapping point, comprising: a service type determination module configured to determine the service type represented by the traffic information of an access end in response to an access request sent by the access end; and an attack behavior defense module configured to, in the case that the service type represented by the traffic information is an attack behavior flow, determine a virtual address represented by the traffic information according to the deployed flow table topology corresponding to the change period and the destination identifier represented by the traffic information, so that the traffic information is transmitted to the virtual address, and an alarm semantic signal is generated.

[0014] According to the embodiments of the present application, the accurate identification and targeted trapping of attack traffic are realized, and an intelligent protection barrier is constructed for the SDN security defense. When the access end initiates a request, the system can quickly identify the business type corresponding to the traffic, accurately distinguish the normal business instruction and attack behavior flow, and intercept the penetration attempt of malicious traffic from the source. After determining the attack behavior flow, the system will rely on the flow table topology corresponding to the current change period, match the corresponding honeypot virtual address, guide the attack traffic to the honeypot virtual address, realize the complete isolation of the real business node and the attack, and protect the core industrial control business from zero interference. At the same time, the system can automatically generate an alarm signal to provide a clear basis for threat tracing, and can also link the subsequent defense components to start emergency disposal, greatly improving the response and disposal efficiency of attack events, and building a strong network security defense line. BRIEF DESCRIPTION OF DRAWINGS

[0015] The above and other objects, features and advantages of the present application will become more apparent from the following description of the embodiments of the present application taken with reference to the accompanying drawings, in which:

[0016] Figure 1 An exemplary system architecture to which the dynamic defense method and device of the extended honeypot mapping point of the present application can be applied is schematically shown;

[0017] Figure 2 A flowchart of the dynamic defense method of the extended honeypot mapping point according to the embodiments of the present application is schematically shown;

[0018] Figure 3 A block diagram of the dynamic defense device of the extended honeypot mapping point according to the embodiments of the present application is schematically shown;

[0019] Figure 4 A block diagram of an electronic device suitable for implementing the dynamic defense method of the extended honeypot mapping point according to the embodiments of the present application is schematically shown. DETAILED DESCRIPTION

[0020] Hereinafter, embodiments of the present application will be described with reference to the accompanying drawings. It is to be understood, however, that the description is merely exemplary of the present application, and is not intended to limit the scope of the present application. In the following detailed description of the embodiments of the present application, numerous specific details are set forth in order to provide a thorough understanding of the present application. However, it will be apparent to one skilled in the art that one or more embodiments of the present application can be practiced without these specific details. In other instances, well-known structures and functions have not been described in detail in order to avoid obscuring aspects of the present application.

[0021] The terms used herein are merely used to describe specific embodiments, and are not intended to limit the present application. The terms "include", "comprise" and the like used herein indicate the presence of the described features, steps, operations and / or components, but do not exclude the presence or addition of one or more other features, steps, operations or components.

[0022] All terms used herein, including technical and scientific terms, have the meanings as commonly understood by one of ordinary skill in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning that is consistent with the context of the specification, and should not be interpreted in an idealized or overly formal way.

[0023] In the case of using expressions similar to "at least one of A, B, and C, etc.", it should generally be interpreted that the expression includes at least one of A, B, and C, etc. (for example, "a system having at least one of A, B, and C" should include but not be limited to a system having A alone, a system having B alone, a system having C alone, a system having both A and B, a system having both A and C, a system having both B and C, and / or a system having A, B, and C, etc.).

[0024] In the embodiments of the present application, the collection, updating, analysis, processing, use, transmission, provision, disclosure, storage, etc. of the data involved (for example, including but not limited to user personal information) comply with the relevant legal regulations, are used for legal purposes, and do not violate public order and good customs. In particular, necessary measures have been taken to prevent illegal access to user personal information data, to maintain user personal information security, network security, and national security.

[0025] In the embodiments of the present application, the authorization or consent of the user is obtained before the user's personal information is acquired or collected.

[0026] The core problems existing in the prior art include: (1) honeypot is easy to identify: fixed IP + single feature, attackers can quickly exclude honeypot and directly locate real assets; (2) poor concealment of real IP: NAT / static SDN scheme cannot dynamically change IP, and real IP is easy to be exposed by long-term scanning; (3) narrow defense range: only protecting real assets or deploying a small number of honeypots, which cannot form a closed loop of "full range coverage + trap capture"; (4) low response efficiency: no real-time alarm and automatic tracing, manual intervention is needed after attack, which delays the processing opportunity.

[0027] To solve the above-mentioned pain points of "easy-to-identify honeypot, real IP exposure, narrow defense range, and slow response", the present application combines the centralized flow table control capability of SDN and the attack capture capability of honeypot, and proposes a scheme of "extended honeypot mapping point + periodic dynamic IP": the honeypot coverage is extended through Vip pool, the real IP is hidden through periodic flow table update, and real-time response is realized through security policy library linkage, finally forming a full-process defense of "hiding-capturing-tracing", filling the gap of the prior art.

[0028] Figure 1An exemplary system architecture to which the dynamic defense method and device of the extended honeypot mapping point of the present application can be applied is shown schematically. It should be noted that Figure 1 The shown is only an example of the system architecture to which the embodiments of the present application can be applied, to help those skilled in the art understand the technical content of the present application, but does not mean that the embodiments of the present application cannot be used in other devices, systems, environments or scenarios.

[0029] As Figure 1 shown, the system architecture 100 according to the embodiment can include devices 101 of a service area, devices 102 of an office area, and a switch 103. The switch 103 is used to provide a communication link between the devices 101 of the service area and the devices 102 of the office area.

[0030] A user can use the devices 102 of the office area to interact with the devices 101 of the service area through the switch 103.

[0031] The types of devices of the office area can vary according to the scenario, and can be divided into terminal access type, office collaboration type, etc., wherein the terminal access type devices can include ordinary office PCs, notebook computers, mobile terminals, etc.; the office collaboration type devices can include printers, copiers, scanners, projectors, etc.

[0032] The types of devices of the service area can be divided into multiple categories according to business attributes, for example, the types of devices of the service area can be divided into data storage type devices and security defense type devices, etc. Among them, the data storage type devices can include database servers, backup servers, etc., and the security defense type devices can include honeypot clusters, log and audit devices, etc.

[0033] Figure 2 A flowchart of the dynamic defense method of the extended honeypot mapping point according to the embodiments of the present application is shown schematically. The dynamic defense method of the extended honeypot mapping point can be executed in the switch.

[0034] As Figure 2 shown, the method includes operations S201-S202.

[0035] In operation S201, in response to the access request sent by the access end, the type of service represented by the traffic information of the access end is determined.

[0036] In operation S202, in the case that the type of service represented by the traffic information is an attack behavior flow, the virtual address represented by the traffic information is determined according to the deployed flow table topology corresponding to the change period and the destination identifier represented by the traffic information, so that the traffic information is transmitted to the virtual address, and an alarm semantic signal is generated.

[0037] In the embodiments of the present application, the access end is an office device; the office device sends traffic to the switch, which is equivalent to an access request for accessing the device in the service area; after receiving the traffic sent by the access end, the switch determines the service type of the traffic according to the traffic information of the traffic.

[0038] The change period can be set to be multiple, each change period can be the same or different, each change period has a corresponding flow table, and the multiple change periods are switched according to a preset order or a preset rule. Correspondingly, the flow table is also switched correspondingly, and the flow table corresponding to the change period is deployed.

[0039] The flow table can represent a first mapping relationship between the network address represented by the destination identifier and the network address represented by the real identifier, or a second mapping relationship between the network address represented by the destination identifier and the virtual address.

[0040] According to the flow table corresponding to the change period, the access end determines the network address represented by the destination identifier corresponding to the network address represented by the real identifier to be accessed, so that the traffic information represents the destination identifier, and sends the data packet of the traffic information to the switch; in the case of the service type being an attack behavior flow, the switch sends the received traffic information to the virtual address according to the first mapping relationship. The virtual address corresponds to a honeypot exclusive Vip node, and the network address represented by the real identifier corresponds to the network address actually wanted to be accessed by the access end.

[0041] According to the embodiments of the present application, by setting multiple change periods, the periodic topology evolution of the mapping nodes (mapping relationship) represented by the flow table is realized, and the network defense security is improved.

[0042] According to the embodiments of the present application, in the case that the service type represented by the traffic information is a legal service flow, the real identifier represented by the traffic information is determined according to the deployed flow table topology corresponding to the change period and the destination identifier represented by the traffic information, so that the traffic information is transmitted to the network address represented by the real identifier.

[0043] In the embodiments of the present application, in the case that the service type is a legal service flow, the switch sends the received traffic information to the network address represented by the real identifier according to the second mapping relationship.

[0044] According to the embodiments of the present application, the dynamic defense method of the honeypot mapping point further includes: in response to the received feedback request sent by the back end, determining the destination identifier represented by the data packet fed back by the back end according to the real identifier represented by the data packet fed back by the back end and the deployed flow table topology corresponding to the change period, so that the data packet is transmitted to the network address represented by the destination identifier.

[0045] In the embodiment of the present application, the backend is the device of the service area. The switch will send the data packet sent by the access end to the network address represented by the real identity according to the second mapping relationship, that is, the network address corresponding to the device of the service area, that is, the backend. The backend processes the received data packet and feeds back the corresponding data packet to the access end in response to the received data packet sent by the access end, which is equivalent to sending a feedback request to the switch. The second mapping relationship of the switch determines the network address corresponding to the destination identity, that is, the network address of the access end, so as to feed back the data packet fed back by the backend to the access end.

[0046] In the four processes of sending the data packet to the switch by the access end, sending the data packet sent by the access end to the backend by the switch, sending the feedback data packet to the switch by the backend, and sending the data packet fed back by the backend to the access end by the switch, when there is no change period switching, the first mapping relationship and the second mapping relationship both correspond to the deployed flow table topology corresponding to the change period. In the four processes, when there is change period switching, the access end can identify the corresponding change period when sending the data packet to the switch. In the three processes of sending the data packet sent by the access end to the backend by the switch, sending the feedback data packet to the switch by the backend, and sending the data packet fed back by the backend to the access end by the switch, the second mapping relationship is determined according to the flow table corresponding to the identified change period, so as to realize the transmission of the data packet.

[0047] According to the embodiment of the present application, the determination method of the deployed flow table topology corresponding to the change period comprises: completing the global topology perception of the backend resource pool by the multi-dimensional asset probe, and determining the network identity of the real business node; for each change period, constructing a heterogeneous virtual network address mapping pool corresponding to each change period according to the first mapping relationship between the network address represented by the real identity corresponding to the network address represented by the network identity of the real business node and the network address represented by the destination identity, and the second mapping relationship between the network address represented by the destination identity corresponding to the network address represented by the network identity of the non-real business node and the virtual address; converting the heterogeneous virtual network address mapping pool into executable flow table topology instructions, and executing the flow table topology instructions to obtain the deployed flow table topology corresponding to the change period.

[0048] In the embodiment of the present application, the multi-dimension of the asset probe can involve physical properties, logical properties, etc. The asset probe of the physical property dimension can distinguish physical devices and virtual assets (honeypot Vip), and the asset probe of the logical property dimension can identify the network identity of the asset, distinguish real network addresses and unreal network addresses, and determine the network identity of the real business node according to the real network address.

[0049] The network identifier of the real service node can be the network identifier of the physical device. For example, the network identifier of the real service node is denoted as A, the network address of the physical device is denoted as A1, A1 is the network address of the real service node, in the case where the physical device represented by the network identifier A needs to access the physical device represented by the network identifier B, if the network address of the physical device represented by the network identifier B is B1, the real identifier is B, the network address represented by the real identifier B is B1, a destination identifier C corresponding to the physical device represented by the network identifier A is preset, and the network address represented by the destination identifier C is C1, then the first mapping relationship is a mapping relationship between the network address C1 represented by the destination identifier C and the network address B1 represented by the real identifier B.

[0050] The network identifier of the non-real service node can be the network identifier of the physical device. For example, the network identifier of the physical device is D, a destination identifier E corresponding to the network identifier D is preset, the network address of the destination identifier E is E1, a virtual identifier F and the network address F1 represented by the virtual identifier F are preset, F1 can be used as a virtual address, and then the second mapping relationship is a mapping relationship between the network address E1 of the destination identifier E and the virtual address F1. In the case where the virtual address F1 corresponds to a honeypot exclusive Vip node, the traffic sent by the non-real service node can be transmitted to the honeypot exclusive Vip node.

[0051] After the heterogeneous virtual network address mapping pool is converted into executable flow table topology instructions, the flow table topology represented by the flow table topology instructions is subjected to flow table semantic legality verification. The application updates the flow table topology instructions by using the verified flow table topology instructions, executes the updated flow table topology instructions, and obtains the deployed flow table topology corresponding to the change period.

[0052] According to the embodiments of the present application, based on machine learning, the historical service traffic of the backend resource pool is subjected to feature extraction, and the features of the normal service traffic are obtained. The features of the normal service traffic are used as a benchmark reference to determine the service type represented by the traffic information of the access end.

[0053] In the embodiments of the present application, by extracting the features of the historical service traffic of the backend resource pool, the switch can distinguish whether the received traffic information is sent by the real service node as the access end or sent by the non-real service node as the access end. If the traffic information is sent by the real service node as the access end, the service type of the traffic information is a legal service flow, and if the traffic information is sent by the non-real service node as the access end, the service type of the traffic information is an attack behavior flow.

[0054] The machine learning can select a long short-term memory network, a one-dimensional convolutional neural network, or a machine learning model based on a self-attention mechanism; the features of the normal service traffic can include one or more of time sequence and statistical features, session and behavior features, topology and association features, or service semantic features, wherein the time sequence and statistical features represent the basic law of the service traffic, for example, traffic size, which can be the average number of data packets per unit time or the average number of bytes per unit time, etc.; the session and behavior features represent the interaction law of the service traffic, for example, protocol and message features, which can be the proportion of using network protocol types or the fixed format of the request message header field, etc.; the topology and association features represent the link law of the traffic, for example, dependency relationship features, which can be whether there is a fixed sequential dependency between nodes, such as the traffic of the statistical server always being generated 30 minutes later than the traffic of the business server; and the service semantic features represent the service attribute of the traffic, for example, service type features, which can be the service classification corresponding to the traffic, such as payment service, user login service, etc.

[0055] According to an embodiment of the present application, the dynamic defense method of extending the honeypot mapping point further includes: performing semantic log archiving on the traffic information transmitted to the virtual address and performing attack tracing on the traffic information transmitted to the virtual address.

[0056] According to an embodiment of the present application, the global topology perception and right of the backend resource pool are completed by the multi-dimensional asset probe, the IP identification (Rip, real Internet Protocol address) of the real business node is extracted, and the business classification corresponding to the real business is determined according to the pre-constructed business type, and the semantic graph associated with the IP is determined.

[0057] For example, the servers, network-related devices, virtual network resources, etc. included in the backend resource pool are determined by the multi-dimensional asset probe, the connection relationship between the resources is determined, and the resources that actually undertake the business and the IP identification of the real business node corresponding to the resources are determined. The resources or devices in the backend resource pool are classified according to the business type, for example, the business type can be divided into responsible for payment, responsible for storage, responsible for user login, etc., and then the information of the resources, the connection relationship between the resources, the IP identification, and the corresponding business type are taken as the semantic graph associated with the IP.

[0058] Machine learning is applied to extract features of historical service traffic of the backend resource pool to obtain features of normal service traffic. The obtained features of normal service traffic can be one or more. The features of normal service traffic are taken as a reference, that is, one feature included in the features of normal service traffic is taken as a reference, or at least one feature in the multiple features is taken as a reference.

[0059] In the application, at least one feature of normal traffic is used as a reference to classify the current traffic, the machine learning of feature extraction of historical traffic is used to extract the current traffic features, the current traffic features are matched with at least one feature of normal traffic respectively, when at least one feature of normal traffic matches the current traffic feature, it is considered that the current traffic corresponding to the current traffic feature is a legal traffic flow; when all the features of normal traffic do not match the current traffic feature, it is considered that the current traffic corresponding to the current traffic feature is an attack behavior flow.

[0060] A heterogeneous virtual IP (Vip) mapping pool is constructed, which contains two types of core mapping nodes: the first type is a virtual IP (Vip) node corresponding to a Rip, which is a heterogeneous entrance for external service access; the second type is a honeypot dedicated Vip node simulating a virtual mapping terminal of real business, which does not have actual business bearing and only serves as a capture carrier for attack behavior.

[0061] Specifically, the first type is that the virtual IP (Vip) corresponds to the real business Rip, when accessing externally, the user accesses the virtual IP (Vip), which will be transferred to the corresponding real business Rip; for non-real business or attack behavior flow, the virtual IP (Vip) looks like a normal business entrance, which is used to confuse the judgment of the user transmitting non-real business or attack behavior flow. Moreover, the correspondence between the virtual IP (Vip) and the real business Rip can be changed according to a preset rule, rather than being fixed, so that it is difficult for the user transmitting non-real business or attack behavior flow to determine the real business Rip corresponding to the virtual IP (Vip).

[0062] The second type is that the virtual IP (Vip) corresponds to the honeypot dedicated Vip; the honeypot dedicated Vip can be disguised as a normal business, such as a payment business IP or a login business IP, but in fact the honeypot dedicated Vip has no real business server and is only an empty "trap".

[0063] Since the correspondence between the virtual IP (Vip) and the real business Rip can be changed according to a preset rule, for example, the change period of the virtual IP (Vip) is set to 2 hours, or the fixed time change is set every day, for example, at 3 o'clock in the morning every day. However, the virtual IP (Vip) is not changed randomly, but is changed within a set range, in a certain network segment, or can only be changed into a payment business IP or a login business IP.

[0064] According to the information of the attack behavior flow in the historical service flow, a defense rule is set, for example, if a user transmitting non-real service or attack behavior flow continuously scans the virtual IP (Vip) 192.168.100.20 more than a preset number of times, then the virtual IP (Vip) 192.168.100.20 is set as a black list, and the user transmitting non-real service or attack behavior flow is directly rejected when accessing the virtual IP (Vip) 192.168.100.20 again, and the corresponding non-real service or attack behavior flow can be further transferred to the honeypot corresponding to the honeypot special Vip.

[0065] According to the preset rule, the correspondence between the virtual IP (Vip) and the real service real Rip or the correspondence between the virtual IP (Vip) and the honeypot special Vip in each change period, that is, in the change period, is determined.

[0066] According to the preset rule, the correspondence between the virtual IP (Vip) and the real service real Rip, the correspondence between the virtual IP (Vip) and the honeypot special Vip, and the defense rule, the flow table topology instruction is converted.

[0067] Specifically, in the conversion process, when the access end initiates an access to the virtual IP (Vip), if the traffic information sent by the access end represents a legal service flow, then according to the correspondence between the virtual IP (Vip) and the real service real Rip, the real service real Rip is determined according to the virtual IP (Vip), and then the data packet sent by the access end is sent to the real service real Rip. If the traffic information sent by the access end represents an attack behavior flow, then according to the correspondence between the virtual IP (Vip) and the honeypot special Vip, the honeypot special Vip is determined according to the virtual IP (Vip), and then the data packet sent by the access end is sent to the honeypot special Vip.

[0068] That is, when the user accesses the virtual IP (Vip), the gateway changes the access target from the virtual IP (Vip) to the real service real Rip / honeypot special Vip, and then transfers the traffic, and the user is completely unaware of the change.

[0069] When the real service real Rip wants to feedback data to the access end, the gateway will change the real service real Rip represented by the feedback data into the corresponding virtual IP (Vip), and then feedback to the access end; that is, when the real service real Rip feedbacks data to the user, the gateway will change the source of the data from the real service real Rip to the virtual IP (Vip), and the user still sees the feedback of the virtual IP (Vip) and does not know the existence of the real real service real Rip.

[0070] The flow table topology instruction completes the legality verification of the flow table semantics, and the flow table topology that passes the verification is sent to the gateway to complete the flow table deployment.

[0071] The gateway processes the current service traffic according to the flow table topology, and after the change period, a new flow table topology is updated, and then the gateway continues to process the data packet sent by the access end according to the new flow table topology. According to the defense rules in the flow table topology, the attack behavior flow is defended, including recording the information represented by the attack behavior flow table received by the honeypot exclusive Vip, and performing attack tracing, tracking which virtual IP (Vip) the user sending the attack behavior flow has accessed, through which network entrance, before accessing the honeypot exclusive Vip, which virtual IP (Vip) has been accessed, and which flow sending method is adopted by the user sending the attack behavior flow, for example, the port scanning method or the malicious data packet sending method, which business type the accessed honeypot exclusive Vip is, and further determining the real network address of the user sending the attack behavior flow, the network area to which the user belongs and other information.

[0072] The following application of a specific scenario will further illustrate the embodiments of the present application:

[0073] The network is divided into two areas, a server area and an office area, and an SDN switch is arranged between the two areas. When the user in the office area needs to access the server real service, such as the service of (192.168.21.222), after the dynamic change is configured, the virtual IP is set to 192.168.21.100-192.168.21.190, and it is assumed that the dynamic IP address is 192.168.21.100 at this moment. Therefore, when the user in the office area wants to access the real service, 192.168.21.100 (Vip) needs to be used for access, and when passing through the SDN switch, the target IP is replaced with 192.168.21.222 (rip) and sent to the real service. When the real service responds to the data packet, the source IP is modified to 192.168.21.100 (Vip) through the SDN switch, and the communication is completed.

[0074] Figure 3A block diagram of a dynamic defense device of an extended honeypot mapping point is shown schematically according to an embodiment of the present application.

[0075] As shown in Figure 3 The dynamic defense device of the extended honeypot mapping point 300 includes a service type determination module 310 and an attack behavior defense module 320.

[0076] The service type determination module 310 is configured to determine a service type represented by traffic information of an access terminal in response to an access request sent by the access terminal.

[0077] The attack behavior defense module 320 is configured to, in a case where the service type represented by the traffic information is an attack behavior flow, determine a virtual address of the traffic information according to a deployed flow table topology corresponding to a change period and a destination identifier represented by the traffic information, so as to transmit the traffic information to the virtual address, and generate an alarm semantic signal.

[0078] Any one or more of the modules, sub-modules, units, sub-units according to the embodiments of the present application, or at least part of the functions of any one or more of the modules, sub-modules, units, sub-units can be implemented in one module. Any one or more of the modules, sub-modules, units, sub-units according to the embodiments of the present application can be split into multiple modules for implementation. Any one or more of the modules, sub-modules, units, sub-units according to the embodiments of the present application can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or any other reasonable manner of hardware or firmware through integration or packaging of a circuit, or in any one of software, hardware and firmware or in an appropriate combination of any of the foregoing. Alternatively, one or more of the modules, sub-modules, units, sub-units according to the embodiments of the present application can be at least partially implemented as a computer program module that can perform corresponding functions when the computer program module is run.

[0079] For example, any of the plurality of the service type determining module 310 and the attack behavior defending module 320 can be combined in one module / unit / sub-unit, or any of the module / unit / sub-unit can be split into a plurality of modules / units / sub-units. Or, at least part of the function of one or more of the modules / units / sub-units can be combined with at least part of the function of other modules / units / sub-units, and implemented in one module / unit / sub-unit. According to the embodiments of the present application, at least one of the service type determining module 310 and the attack behavior defending module 320 can be at least partially implemented as hardware circuit, such as field programmable gate array (FPGA), programmable logic array (PLA), system on chip, system on board, system in package, application specific integrated circuit (ASIC), or any other reasonable way of integrating or packaging the circuit, etc. hardware or firmware, or implemented in any one of software, hardware and firmware or in a proper combination of any of them. Or, at least one of the service type determining module 310 and the attack behavior defending module 320 can be at least partially implemented as computer program module, which can perform corresponding function when the computer program module is run.

[0080] It should be noted that the data processing system part in the embodiments of the present application corresponds to the data processing method part in the embodiments of the present application, and the description of the data processing system part is specifically referred to the data processing method part, which will not be repeated here.

[0081] Figure 4 A block diagram of an electronic device suitable for implementing the dynamic defense method of extended honeypot mapping point according to the embodiments of the present application is schematically shown. Figure 4 The electronic device shown is only an example, and should not bring any limitation to the function and use range of the embodiments of the present application.

[0082] As shown in Figure 4 The electronic device 400 according to the embodiments of the present application includes a processor 401, which can perform various appropriate actions and processes according to the program stored in the read only memory (ROM) 402 or the program loaded from the storage part 408 to the random access memory (RAM) 403. The processor 401 can include, for example, general microprocessor (such as CPU), instruction set processor and / or related chipset and / or special microprocessor (such as application specific integrated circuit (ASIC), etc.). The processor 401 can also include on-board memory for cache use. The processor 401 can include single processing unit or multiple processing units for performing different actions of the method flow according to the embodiments of the present application.

[0083] In the RAM 403, various programs and data required for the operation of the electronic device 400 are stored. The processor 401, the ROM 402, and the RAM 403 are connected to each other via the bus 404. The processor 401 performs various operations of the method flow according to the embodiments of the present application by executing the programs in the ROM 402 and / or the RAM 403. It is to be noted that the programs can also be stored in one or more memories other than the ROM 402 and the RAM 403. The processor 401 can also perform various operations of the method flow according to the embodiments of the present application by executing the programs stored in the one or more memories.

[0084] According to the embodiments of the present application, the electronic device 400 can further include an input / output (I / O) interface 405, which is also connected to the bus 404. The electronic device 400 can further include one or more of the following components connected to the input / output (I / O) interface 405: an input part 406 including a keyboard, a mouse, etc.; an output part 407 including a display such as a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage part 408 including a hard disk, etc.; and a communication part 409 including a network interface card such as a LAN card, a modem, etc. The communication part 409 performs communication processing via a network such as the Internet. A drive 410 is also connected to the input / output (I / O) interface 405 as necessary. A removable medium 411 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc. is attached to the drive 410 as necessary, so that a computer program read therefrom is installed in the storage part 408 as necessary.

[0085] According to the embodiments of the present application, the method flow according to the embodiments of the present application can be implemented as a computer software program. For example, the embodiments of the present application include a computer program product comprising a computer program carried on a computer-readable storage medium, the computer program containing program codes for executing the method shown in the flowchart. In such embodiments, the computer program can be downloaded and installed from a network by the communication part 409, and / or installed from the removable medium 411. When the computer program is executed by the processor 401, the above-described functions defined in the system of the embodiments of the present application are performed. According to the embodiments of the present application, the system, the device, the apparatus, the module, the unit, etc. described above can be implemented by computer program modules.

[0086] The application further provides a computer readable storage medium, which can be included in the device / apparatus / system described in the above embodiments, or can exist independently without being assembled into the device / apparatus / system. The computer readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of the application.

[0087] According to the embodiments of the application, the computer readable storage medium can be a non-volatile computer readable storage medium. For example, it can include but is not limited to: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In this application, a computer readable storage medium can be any tangible medium that contains or stores a program, which can be used by or in connection with an instruction execution system, apparatus, or device.

[0088] For example, according to the embodiments of the application, the computer readable storage medium can include the ROM 402 and / or the RAM 403 described above and / or one or more memories other than the ROM 402 and the RAM 403.

[0089] The embodiments of the application also include a computer program product, which includes a computer program containing program codes for executing the method provided by the embodiments of the application, and when the computer program product is run on an electronic device, the program codes are used to make the electronic device implement the dynamic defense method of extended honeypot mapping point provided by the embodiments of the application.

[0090] When the computer program is executed by the processor 401, the above functions defined in the system / apparatus of the embodiments of the application are executed. According to the embodiments of the application, the system, apparatus, module, unit, etc. described above can be implemented by computer program modules.

[0091] In one embodiment, the computer program can rely on tangible storage media such as optical storage media, magnetic storage media, etc. In another embodiment, the computer program can also be transmitted, distributed, downloaded and installed in the form of signals on a network medium, and be downloaded and installed through the communication part 409 and / or installed from the detachable medium 411. The program codes contained in the computer program can be transmitted by any suitable network medium, including but not limited to wireless, wired, etc., or any suitable combination of the foregoing.

[0092] According to an embodiment of the present application, program code for implementing the computer programs provided by the embodiments of the present application can be written in any combination of one or more programming languages, and specifically, can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. The programming languages include, but are not limited to, such as Java, C++, python, "C" language, or similar programming languages. The program code can be executed entirely on a user computing device, partially on a user device, partially on a remote computing device, or entirely on a remote computing device or server. In the case involving a remote computing device, the remote computing device can be connected to the user computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, connected to the Internet through an Internet service provider).

[0093] The flow diagrams and the block diagrams in the drawings are illustrations of possible architectures, functions, and operations for systems, methods, and computer program products according to various embodiments of the present application. In this regard, each block in the flow diagrams or block diagrams can represent a module, a segment, or a portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that in some alternative implementations, the functions noted in the blocks can occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently or the blocks may

[0094] The embodiments of the present application are described above. However, these embodiments are merely for the purpose of illustration, and are not intended to limit the scope of the present application. Although each embodiment is described above separately, this does not mean that the measures in each embodiment cannot be used advantageously in combination. Without departing from the scope of the present application, those skilled in the art can make various substitutions and modifications, and these substitutions and modifications shall fall within the scope of the present application.

Claims

1. A dynamic defense method for expanding honeypot mapping points, characterized in that, The method includes: In response to a received access request from an accessing client, the service type represented by the traffic information of the accessing client is determined; When the service type represented by the traffic information is an attack behavior flow, the virtual address of the traffic information representation is determined according to the deployed flow table topology corresponding to the change cycle and the destination identifier of the traffic information representation, so that the traffic information is transmitted to the virtual address and an alarm semantic signal is generated.

2. The dynamic defense method for expanding honeypot mapping points according to claim 1, characterized in that, When the service type represented by the traffic information is a legitimate service flow, the true identifier of the traffic information is determined based on the deployed flow table topology corresponding to the change cycle and the destination identifier of the traffic information, so that the traffic information is transmitted to the network address represented by the true identifier.

3. The dynamic defense method for expanding honeypot mapping points according to claim 2, characterized in that, The method further includes: In response to a received feedback request from the backend, the destination identifier of the data packet represented by the backend is determined based on the real identifier of the data packet represented by the backend and the deployed flow table topology corresponding to the change period, so that the data packet is transmitted to the network address represented by the destination identifier.

4. The dynamic defense method for expanding honeypot mapping points according to claim 2, characterized in that, The method for determining the deployed flow table topology corresponding to the change cycle includes: By using multi-dimensional asset probes to achieve full-domain topology awareness of the backend resource pool, the network identifiers of real business nodes can be determined. For each change cycle, a heterogeneous virtual network address mapping pool corresponding to each change cycle is constructed based on a first mapping relationship between the network address represented by the real identifier corresponding to the network address represented by the network identifier of the real service node and the network address represented by the destination identifier, and a second mapping relationship between the network address represented by the destination identifier corresponding to the network address represented by the network identifier of a non-real service node and the virtual address. The heterogeneous virtual network address mapping pool is converted into executable flow table topology instructions, and the flow table topology instructions are executed to obtain the deployed flow table topology corresponding to the change cycle.

5. The dynamic defense method for expanding honeypot mapping points according to claim 1, characterized in that, Using the characteristics of normal business traffic as a benchmark, the business type represented by the traffic information of the access terminal is determined.

6. The dynamic defense method for expanding honeypot mapping points according to claim 5, characterized in that, The methods for determining the characteristics of the normal business traffic include: Based on machine learning, features are extracted from the historical business traffic of the backend resource pool to obtain the features of normal business traffic.

7. The dynamic defense method for expanding honeypot mapping points according to claim 1, characterized in that, The method further includes: The traffic information transmitted to the virtual address is archived using semantic logging.

8. The dynamic defense method for expanding honeypot mapping points according to claim 1, characterized in that, The method further includes: Attack tracing is performed on the traffic information transmitted to the virtual address.

9. The dynamic defense method for expanding honeypot mapping points according to claim 4, characterized in that, After converting the heterogeneous virtual network address mapping pool into executable flow table topology instructions, the method further includes: Perform flow table semantic validity verification on the flow table topology represented by the flow table topology instruction; The application updates the flow table topology instructions by verifying the flow table topology instructions.

10. A dynamic defense device for expanding honeypot mapping points, characterized in that, The device includes: The service type determination module is used to determine the service type represented by the traffic information of the access terminal in response to the received access request sent by the access terminal; The attack behavior defense module is used to determine the virtual address of the traffic information representation based on the deployed flow table topology corresponding to the change cycle and the destination identifier of the traffic information representation when the service type represented by the traffic information is an attack behavior flow, so that the traffic information is transmitted to the virtual address and an alarm semantic signal is generated.

Images