Dynamic honeypot implementation method, system and equipment based on HTTP (Hyper Text Transport Protocol) proxy and medium

Abstract

The invention discloses a dynamic honeypot implementation method, system and device based on an HTTP proxy and a medium, and the method comprises the steps: obtaining an HTTP request of a client, obtaining an HTTP response message by responding to the HTTP request, analyzing the HTTP response message through a predefined honeypot security policy to obtain response analysis data, and according to a preset dynamic camouflage rule, carrying out the dynamic camouflage of the client on the basis of the dynamic camouflage of the client, and carrying out the dynamic camouflage of the client on the basis of the dynamic camouflage of the client. And performing camouflage modification on the response analysis data, injecting bait data, generating camouflage HTTP response data for inducing an attacker to perform interaction, obtaining a unique identifier of the HTTP request, performing data association on the camouflage HTTP response data and the unique identifier, and storing the data in a cache region. And dynamically updating the cache response data of the cache region, and returning the disguised HTTP response data as HTTP response from the updated cache region to the client. The method and the device have the advantages that adjustment is performed timely according to changes of network attack means, and the current network security protection requirement is met.

Description

Technical Field

[0001] This invention relates to the technical field of network security defense, and in particular to a method, system, device and medium for implementing dynamic honeypots based on HTTP proxies. Background Technology

[0002] Currently, with the rapid development of information technology, cybersecurity attacks have transformed from simple, single attack patterns into complex, diverse, and persistent attack patterns. The inherent resource and information asymmetry of traditional defense methods leave defenders in a passive position, placing higher demands on defense methods against complex and ever-changing cyberattacks.

[0003] Existing network security defense methods typically employ honeypot technology for proactive defense. This involves setting up decoy systems to attract attackers, capturing attack behavior, and collecting relevant information for proactive defense. However, existing honeypot technologies usually use static configuration methods, and once deployed, the vulnerability characteristics of the honeypot are fixed, making it difficult to quickly adjust according to changes in security requirements and respond to new attack methods in real time. When faced with increasingly complex and ever-changing network attack methods, the current static and fixed honeypot systems are insufficient to meet the needs of network security protection. Summary of the Invention

[0004] To address the problem that existing static and fixed honeypot systems are unable to cope with complex and ever-changing network attack methods, this invention provides a dynamic honeypot implementation method, system, device, and medium based on an HTTP proxy. By dynamically configuring the honeypot system, its flexibility and scalability can be improved, allowing for timely adjustments based on changes in network attack methods and meeting current network security protection needs.

[0005] Firstly, the above-mentioned inventive objective of this application is achieved through the following technical solution: A method for implementing a dynamic honeypot based on an HTTP proxy, the method comprising: Obtain the client's HTTP request, retrieve the HTTP response message by responding to the HTTP request, and parse the HTTP response message using a predefined honeypot security policy to obtain the response parsing data; According to the preset dynamic spoofing rules, the response parsing data is spoofed and modified and decoy data is injected to generate spoofed HTTP response data that induces attackers to interact. Obtain the unique identifier of the HTTP request, associate the fake HTTP response data with the unique identifier and store it in the cache area, and dynamically update the cached response data in the cache area; The spoofed HTTP response data is returned to the client as an HTTP response from the updated cache.

[0006] In a preferred embodiment, this application can be further configured as follows: obtaining the client's HTTP request, obtaining the HTTP response message by responding to the HTTP request, and parsing the HTTP response message using a predefined honeypot security policy to obtain response parsing data, specifically including: Receive the client's HTTP request and parse it to obtain the client's unique identifier, and respond to the HTTP request to obtain an HTTP response message about the unique identifier; Based on the HTTP response message, the predefined honeypot security policy is dynamically configured with parameters, and the configured honeypot security policy is executed to generate a LUA script that conforms to the HTTP response message; The LUA script parses the HTTP response message to obtain the HTTP response status code, HTTP header information, and response body content, thus obtaining the response parsing data.

[0007] In a preferred embodiment, this application can be further configured as follows: the step of dynamically configuring predefined honeypot security policies based on the HTTP response message, and executing the configured honeypot security policies to generate LUA scripts conforming to the HTTP response message, specifically includes: Based on the HTTP response message, the client's request parameters and request time are obtained and attacker pattern analysis is performed. Combined with the unique identifier, HTTP response parsing parameters are generated. The attack simulation is performed on the HTTP response parsing parameters according to the LUA script logic. Based on each simulation result, the dynamic parameters of the honeypot security policy are configured to obtain a honeypot security policy that can simulate multiple target attack objects. The configured honeypot security policy is executed according to the LUA script logic, generating a LUA script that conforms to the HTTP response message.

[0008] In a preferred embodiment, this application can be further configured such that: the step of generating a LUA script conforming to an HTTP response message based on the honeypot security policy configured according to the LUA script logic further includes: Obtain the request path of the HTTP request, perform security threat trend analysis according to the request path, dynamically adjust the attack behavior simulation mode of the honeypot security strategy according to the security threat trend, and generate a honeypot adjustment strategy that conforms to the security threat trend.

[0009] In a preferred embodiment, this application can be further configured as follows: The step of modifying the response parsing data according to preset dynamic masquerading rules and injecting decoy data to generate masquerading HTTP response data that induces the attacker to interact specifically includes: According to the preset dynamic masquerading rules, the response parsing data is processed to perform service fingerprint masquerading to obtain service fingerprint masquerading data; According to the preset dynamic masquerading rules, the HTTP header information of the response parsing data is modified, and the server mimicry processing is performed on the response parsing data to obtain header information masquerading data; Obtain known vulnerability version information, and replace the version information of the response parsing data with the known vulnerability version information according to the preset dynamic masquerading rules to obtain version masquerading data; The service fingerprint spoofing data, the header information spoofing data, and the version spoofing data are combined and injected with decoy data to generate spoofed HTTP response data that induces attackers to interact.

[0010] In a preferred embodiment, this application can be further configured as follows: the process of combining the service fingerprint spoofing data, the header information spoofing data, and the version spoofing data, and injecting decoy data to generate spoofed HTTP response data that induces an attacker to interact includes: Obtain the response body data of the combined fake HTTP response data, and dynamically configure the decoy data according to the response body data to obtain target decoy data that meets the data format requirements of the response body data; The target decoy data is injected into the response body data to generate fake HTTP response data that induces the attacker to interact. The target decoy data packet contains backdoor information, error messages, or specific markers.

[0011] In a preferred embodiment, this application can be further configured such that the method also includes: Based on the unique identifier in the HTTP request, perform cached response data query processing in the cache area, and determine whether the target cached response data matching the unique identifier has been cached in the cache area; If it exists, the target cached response data will be returned to the client according to the preset fast response strategy.

[0012] Secondly, the above-mentioned inventive objective of this application is achieved through the following technical solutions: A dynamic honeypot implementation system based on an HTTP proxy, the system being applied to the aforementioned dynamic honeypot implementation method based on an HTTP proxy, the system comprising: The configuration management module is used to configure and initialize the basic rules and objectives for the operation of the dynamic honeypot implementation system. The request processing module is used to receive HTTP requests from clients and return cached response data that matches the HTTP request to the client, or forward the HTTP request to the target server. The response processing module is used to receive and process the cached response request from the target server, modify the honeypot security policy configuration of the cached response request, and execute the modified honeypot security policy to perform response processing. The response caching module is used to associate the fake HTTP response data processed by the honeypot security policy with the unique identifier of the HTTP request and cache it in the cache area, and dynamically update the query conditions of the cache area.

[0013] Thirdly, the above-mentioned objectives of this application are achieved through the following technical solutions: A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above-described dynamic honeypot implementation method based on an HTTP proxy.

[0014] Fourthly, the above-mentioned objectives of this application are achieved through the following technical solutions: A computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the above-described dynamic honeypot implementation method based on an HTTP proxy.

[0015] In summary, this application includes at least one of the following beneficial technical effects: 1. Compared to static and fixed honeypot systems, this application uses dynamic masquerading rules to quickly and dynamically modify and inject decoy data into HTTP request response data. This can dynamically generate highly realistic request responses to attract attackers to interact, thereby collecting richer and more valuable attacker information. By associating unique identifiers with masquerading HTTP response data and caching them in real time, the cached HTTP response data can be updated dynamically, enabling rapid responses to HTTP requests from attackers with the same identifier, increasing deception and improving current network security protection performance. Through dynamically configurable honeypot security policies, it can adapt to different attacker attack patterns, improving the flexibility and scalability of the honeypot system. It can also adjust the configuration parameters of the honeypot security policy in a timely manner according to network attack methods, meeting the dynamic, complex and ever-changing protection needs of current network security. 2. This application makes it difficult for attackers to identify the honeypot system through simple feature matching or behavioral analysis by constantly changing response characteristics, thus extending the effective trapping time of the honeypot system. It also responds to new security threats in a timely and rapid manner based on HTTP requests, and adjusts the disguise strategy by updating LUA scripts and configurations to adapt to constantly changing attack methods. 3. This application inserts a dynamic processing layer between the client and the target server, and deploys a honeypot system on the dynamic processing layer to capture and protect against attack behavior. By dynamically configuring the parameters of different honeypot security policies, the honeypot system can simulate multiple target attack objects to confuse attackers. It also uses LUA scripts to deeply and dynamically modify HTTP responses to form LUA scripts that conform to HTTP response messages. Without interfering with normal business or simulating characteristic services, it provides a highly realistic and difficult-to-identify honeypot environment, effectively improving the ability to lure attackers and the stealth of the honeypot. Attached Figure Description

[0016] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the accompanying drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. In all the drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, the elements or parts are not necessarily drawn to scale.

[0017] Figure 1 This is a flowchart illustrating the implementation of the dynamic honeypot implementation method based on an HTTP proxy in this embodiment.

[0018] Figure 2 This is a flowchart illustrating step S10 of the dynamic honeypot implementation method based on HTTP proxy in this embodiment.

[0019] Figure 3 This is a flowchart illustrating step S102 of the dynamic honeypot implementation method based on HTTP proxy in this embodiment.

[0020] Figure 4 This is a flowchart illustrating step S20 of the dynamic honeypot implementation method based on HTTP proxy in this embodiment.

[0021] Figure 5 This is a flowchart illustrating the implementation of the dynamic honeypot method based on an HTTP proxy in this embodiment, which injects decoy data.

[0022] Figure 6 This is another implementation flowchart of the dynamic honeypot implementation method based on HTTP proxy in this embodiment.

[0023] Figure 7 This is a schematic diagram of the module data transmission of the dynamic honeypot implementation system based on HTTP proxy in this embodiment.

[0024] Figure 8 This is a schematic diagram of the internal structure of a computer device used to implement a dynamic honeypot implementation method based on an HTTP proxy. Detailed Implementation

[0025] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0026] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0027] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0028] It should also be further understood that the term "and / or" as used in this specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0029] In one embodiment, such as Figure 1 As shown, this application discloses a method for implementing a dynamic honeypot based on an HTTP proxy, which specifically includes the following steps: S10: Obtain the client's HTTP request, retrieve the HTTP response message by responding to the HTTP request, parse the HTTP response message according to the predefined honeypot security policy, and obtain the response parsing data.

[0030] Specifically, such as Figure 2 As shown, step S10 includes: S101: Receives the client's HTTP request, parses it to obtain the client's unique identifier, and responds to the HTTP request to obtain an HTTP response message about the unique identifier.

[0031] Specifically, it receives HTTP requests from clients, parses the HTTP requests to obtain the client's unique identifier, such as the client's IP address, and responds to HTTP requests to obtain the HTTP response message related to the unique identifier, including request parameters, request purpose, request time, etc.

[0032] S102: Dynamically configure the parameters of the predefined honeypot security policy according to the HTTP response message, and execute the configured honeypot security policy to generate a LUA script that conforms to the HTTP response message.

[0033] Specifically, such as Figure 3 As shown, step S102 includes: S1021: Obtain the client's request parameters and request time from the HTTP response message, perform attacker pattern analysis, and generate HTTP response parsing parameters by combining them with a unique identifier.

[0034] Specifically, the client's request parameters and request time are obtained from the HTTP response message. By combining the request parameters and request time with existing attack data, the attacker's behavior and attack patterns in the HTTP request are analyzed. Combined with a unique identifier, HTTP response parsing parameters are generated, including the unique identifier, request parameters, request time, attacker attack patterns, and attack behaviors.

[0035] S1022: Simulate attacks on HTTP response parsing parameters according to LUA script logic, and dynamically configure honeypot security policy parameters based on each simulation result to obtain a honeypot security policy that can simulate multiple target attack objects.

[0036] Specifically, the attack simulation is performed on the HTTP response parsing parameters according to the LUA script logic. Multiple simulated attack target objects are set as variables for each HTTP response parsing parameter and the simulation is run. The parameters in the honeypot security policy are dynamically configured according to the simulation results to obtain a honeypot security policy that can simulate multiple target attack objects.

[0037] S1023: Execute the configured honeypot security policy according to the LUA script logic and generate a LUA script that conforms to the HTTP response message.

[0038] Specifically, following the configured honeypot security policy executed by the LUA script, responses to different simulated attack targets are generated through LUA script logic. This enables the honeypot to simulate more complex and varied "victim" systems, increasing the difficulty for attackers to identify the true identity of the target, thereby generating LUA scripts that conform to HTTP response messages.

[0039] In this embodiment, step S1023 further includes: Obtain the request path of the HTTP request, perform security threat trend analysis according to the request path, dynamically adjust the attack behavior simulation mode of the honeypot security strategy according to the security threat trend, and generate a honeypot adjustment strategy that conforms to the security threat trend.

[0040] Specifically, the HTTP request path is obtained by parsing the HTTP request, and the security threat trend of the current HTTP request is analyzed according to the request path. Combined with the final attack target of the HTTP request path, the simulation mode of the attack behavior of the honeypot security strategy is adjusted, the attack behavior that conforms to the current security threat trend is simulated, and the honeypot adjustment strategy that conforms to the security threat trend is generated based on the simulation results.

[0041] S103: Parse the HTTP response message using a LUA script to obtain the HTTP response status code, HTTP header information, and response body content, thus obtaining the response parsing data.

[0042] Specifically, the configured honeypot security policy is executed through a LUA script to parse the HTTP response message, obtain the corresponding HTTP status code, HTTP header information and response body content, and obtain the response parsing data.

[0043] S20: According to the preset dynamic masquerading rules, the response parsing data is masqueraded and modified, and decoy data is injected to generate masquerading HTTP response data that induces the attacker to interact.

[0044] Specifically, such as Figure 4 As shown, step S20 includes: S201: According to the preset dynamic masquerading rules, perform service fingerprint masquerading processing on the response parsing data to obtain service fingerprint masquerading data.

[0045] Specifically, according to preset dynamic masquerading rules, the service fingerprint in the response parsing data is masqueraded to obtain service fingerprint masquerading data. In this embodiment, the service fingerprint can be an IP address or a unique identifier.

[0046] S202: According to the preset dynamic masquerading rules, the HTTP header information of the response parsing data is modified, and the server mimicry processing of the response parsing data is performed to obtain the header information masquerading data.

[0047] Specifically, the HTTP header information of the response parsing data is modified according to the preset dynamic masquerading rules. For example, the Server field in the header information is modified to masquerade the modified HTTP request as a server, making it look like a popular web server, such as Apache or Nginx, and thus obtain masquerading data for the header information.

[0048] S203: Obtain known vulnerability version information, and replace the version information of the response parsing data with known vulnerability version information according to the preset dynamic masquerading rules to obtain version masquerading data.

[0049] Specifically, the system obtains known vulnerability version information and, according to preset dynamic masquerading rules, replaces the version information in the response parsing data with outdated version numbers containing known vulnerabilities, thus enticing attackers to attempt to exploit known vulnerabilities and obtain version masquerading data.

[0050] S204: Combine service fingerprint spoofing data, header information spoofing data, and version spoofing data, and inject decoy data to generate spoofed HTTP response data that induces attackers to interact.

[0051] Specifically, using a unique identifier as the key, service fingerprint spoofing data, header information spoofing data, and version spoofing data are combined and injected with decoy data to generate spoofed HTTP response data that induces attackers to conduct further "exploration" or "interaction".

[0052] like Figure 5 As shown, the process of injecting decoy data in step S204 of this embodiment includes: S2041: Obtain the response body data of the combined fake HTTP response data, and dynamically configure the decoy data according to the response body data to obtain target decoy data that meets the data format requirements of the response body data.

[0053] Specifically, the response body data of the combined fake HTTP response data is obtained, and the child data is dynamically configured according to the response body data, including configuring backdoor information, error messages and specific tags, so as to obtain target decoy data that meets the data format requirements of the response body data.

[0054] S2042: Inject target decoy data into the response body data to generate spoofed HTTP response data that induces the attacker to interact. The target decoy data packet contains backdoor information, error messages, or specific markers.

[0055] Specifically, target decoy data is injected into the response body data, such as into the HTML or JSON response body data, to generate disguised HTTP response data that induces attackers to perform further interaction or exploration.

[0056] S30: Obtain the unique identifier of the HTTP request, associate the fake HTTP response data with the unique identifier and store it in the cache, and dynamically update the cached response data in the cache.

[0057] Specifically, the unique identifier of the HTTP request is obtained, the fake HTTP response data is associated with the unique identifier and stored in the cache, and the cached response data with the unique identifier in the cache is dynamically updated.

[0058] S40: Return the spoofed HTTP response data as an HTTP response to the client from the updated cache.

[0059] Specifically, the altered HTTP response data is retrieved from the updated cache and returned to the client as the HTTP response result.

[0060] like Figure 6 As shown, the dynamic honeypot implementation method in this embodiment further includes: S50: Based on the unique identifier in the HTTP request, perform cached response data query processing in the cache area, and determine whether the target cached response data matching the unique identifier has already been cached in the cache area.

[0061] Specifically, in a new round of HTTP requests, the corresponding cached response data is queried in the cache based on the unique identifier in the HTTP request, and the cached response data matching the unique identifier is determined based on the query results.

[0062] S60: If it exists, the target cached response data will be returned to the client according to the preset fast response strategy.

[0063] Specifically, if the cached response exists, the target cached response data is quickly returned to the client according to the preset fast response strategy, increasing the system's deceptiveness through rapid response. If the cached response does not exist, the HTTP request is forwarded to the target server for dynamic honeypot masquerading and response processing.

[0064] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0065] In one embodiment, a dynamic honeypot implementation system based on an HTTP proxy is provided, which corresponds one-to-one with the dynamic honeypot implementation method based on an HTTP proxy in the above embodiments. For example... Figure 7 As shown, this dynamic honeypot implementation system based on an HTTP proxy includes a configuration management module, a request processing module, a response processing module, and a response caching module. Detailed descriptions of each functional module are as follows: The configuration management module is used to configure and initialize the basic rules and objectives for the operation of the dynamic honeypot system.

[0066] The request processing module is used to receive HTTP requests from clients and return cached response data that matches the HTTP request to the client, or forward the HTTP request to the target server.

[0067] The response processing module is used to receive and process cached response requests from the target server, modify the honeypot security policy configuration for the cached response requests, and execute the modified honeypot security policy for response processing.

[0068] The response caching module is used to associate the fake HTTP response data processed by the honeypot security policy with the unique identifier of the HTTP request and cache it in the cache area, and dynamically update the query conditions of the cache area.

[0069] Specific limitations regarding the implementation system of dynamic honeypots based on HTTP proxies can be found in the limitations of the implementation method of dynamic honeypots based on HTTP proxies mentioned above, and will not be repeated here. Each module in the above-mentioned dynamic honeypot implementation system based on HTTP proxies can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0070] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 8 As shown, the computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores dynamic honeypot implementation data for HTTP requests. The network interface communicates with external terminals via a network connection. When executed by the processor, the computer program implements a dynamic honeypot implementation method based on an HTTP proxy.

[0071] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program being executed by a processor to implement the steps of a dynamic honeypot implementation method based on an HTTP proxy.

[0072] Those skilled in the art will recognize that the units of the various examples described in connection with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of the invention.

[0073] In the embodiments provided by the present invention, it should be understood that the division of units is only a logical functional division. In actual implementation, there may be other division methods, such as multiple units can be combined into one unit, one unit can be split into multiple units, or some features can be ignored.

[0074] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0075] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0076] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be covered within the scope of the claims and specification of the present invention.

Claims

1. A method for implementing a dynamic honeypot based on an HTTP proxy, characterized in that, The method includes: Obtain the client's HTTP request, retrieve the HTTP response message by responding to the HTTP request, and parse the HTTP response message using a predefined honeypot security policy to obtain the response parsing data; According to the preset dynamic spoofing rules, the response parsing data is spoofed and modified and decoy data is injected to generate spoofed HTTP response data that induces attackers to interact. Obtain the unique identifier of the HTTP request, associate the fake HTTP response data with the unique identifier and store it in the cache area, and dynamically update the cached response data in the cache area; The spoofed HTTP response data is returned to the client as an HTTP response from the updated cache.

2. The method for implementing a dynamic honeypot based on an HTTP proxy according to claim 1, characterized in that, The process of obtaining the client's HTTP request, receiving the HTTP response message by responding to the HTTP request, and parsing the HTTP response message using a predefined honeypot security policy to obtain response parsing data specifically includes: Receive the client's HTTP request and parse it to obtain the client's unique identifier, and respond to the HTTP request to obtain an HTTP response message about the unique identifier; Based on the HTTP response message, the predefined honeypot security policy is dynamically configured with parameters, and the configured honeypot security policy is executed to generate a LUA script that conforms to the HTTP response message; The LUA script parses the HTTP response message to obtain the HTTP response status code, HTTP header information, and response body content, thus obtaining the response parsing data.

3. The method for implementing a dynamic honeypot based on an HTTP proxy according to claim 1, characterized in that, The step of dynamically configuring predefined honeypot security policies based on the HTTP response message, and then executing the configured honeypot security policies to generate LUA scripts that conform to the HTTP response message, specifically includes: Based on the HTTP response message, the client's request parameters and request time are obtained and attacker pattern analysis is performed. Combined with the unique identifier, HTTP response parsing parameters are generated. The attack simulation is performed on the HTTP response parsing parameters according to the LUA script logic. Based on each simulation result, the dynamic parameters of the honeypot security policy are configured to obtain a honeypot security policy that can simulate multiple target attack objects. The configured honeypot security policy is executed according to the LUA script logic, generating a LUA script that conforms to the HTTP response message.

4. The method for implementing a dynamic honeypot based on an HTTP proxy according to claim 3, characterized in that, The step of generating a LUA script conforming to an HTTP response message by executing the configured honeypot security policy according to the LUA script logic further includes: Obtain the request path of the HTTP request, perform security threat trend analysis according to the request path, dynamically adjust the attack behavior simulation mode of the honeypot security strategy according to the security threat trend, and generate a honeypot adjustment strategy that conforms to the security threat trend.

5. The method for implementing a dynamic honeypot based on an HTTP proxy according to claim 1, characterized in that, The process of modifying and injecting decoy data into the parsed response data according to preset dynamic masquerading rules to generate masquerading HTTP response data that induces attackers to interact specifically includes: According to the preset dynamic masquerading rules, the response parsing data is processed to perform service fingerprint masquerading to obtain service fingerprint masquerading data; According to the preset dynamic masquerading rules, the HTTP header information of the response parsing data is modified, and the server mimicry processing is performed on the response parsing data to obtain header information masquerading data; Obtain known vulnerability version information, and replace the version information of the response parsing data with the known vulnerability version information according to the preset dynamic masquerading rules to obtain version masquerading data; The service fingerprint spoofing data, the header information spoofing data, and the version spoofing data are combined and injected with decoy data to generate spoofed HTTP response data that induces attackers to interact.

6. The method for implementing a dynamic honeypot based on an HTTP proxy according to claim 5, characterized in that, The process of combining the service fingerprint spoofing data, the header information spoofing data, and the version spoofing data, and injecting decoy data to generate spoofed HTTP response data that induces the attacker to interact includes: Obtain the response body data of the combined fake HTTP response data, and dynamically configure the decoy data according to the response body data to obtain target decoy data that meets the data format requirements of the response body data; The target decoy data is injected into the response body data to generate fake HTTP response data that induces the attacker to interact. The target decoy data packet contains backdoor information, error messages, or specific markers.

7. The method for implementing a dynamic honeypot based on an HTTP proxy according to claim 1, characterized in that, The method further includes: Based on the unique identifier in the HTTP request, perform cached response data query processing in the cache area, and determine whether the target cached response data matching the unique identifier has been cached in the cache area; If it exists, the target cached response data will be returned to the client according to the preset fast response strategy.

8. A dynamic honeypot implementation system based on an HTTP proxy, characterized in that, The system is applied to the dynamic honeypot implementation method based on HTTP proxy as described in any one of claims 1-7, and the system includes: The configuration management module is used to configure and initialize the basic rules and objectives for the operation of the dynamic honeypot implementation system. The request processing module is used to receive HTTP requests from clients and return cached response data that matches the HTTP request to the client, or forward the HTTP request to the target server. The response processing module is used to receive and process the cached response request from the target server, modify the honeypot security policy configuration of the cached response request, and execute the modified honeypot security policy to perform response processing. The response caching module is used to associate the fake HTTP response data processed by the honeypot security policy with the unique identifier of the HTTP request and cache it in the cache area, and dynamically update the query conditions of the cache area.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the dynamic honeypot implementation method based on an HTTP proxy as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the dynamic honeypot implementation method based on an HTTP proxy as described in any one of claims 1 to 7.

Images