Honeypot system, flow processing method and device, storage medium and program product

Abstract

The embodiment of the invention provides a honeypot system, a flow processing method and device, a storage medium and a program product. In the embodiment of the invention, the target service is provided by using the IP address and the port of the service node for providing the normal application service in the VPC network to simulate the attacked object, a honeypot node does not need to be independently deployed in each VPC network, that is, the independent IP address and port do not need to be allocated to the honeypot node, so that the resource consumption of the honeypot system across the VPC network can be reduced, and the resource utilization rate of the honeypot system is improved. The network resources comprise IP addresses, ports and the like. In addition, the target service for cheating the attacker and the application service are on the same service node and are not independently deployed on one service node any more, and the computing resource consumption of the honeypot service can also be reduced. And on the other hand, through the client capability and the traffic forwarding capability of the host security service, the attack traffic is drained to the honeypot service system, the isolation limitation of the VPC network is broken through, and honeypot drainage across the VPC network scene is realized.

Description

Technical Field

[0001] This application relates to the field of cloud security technology, and in particular to a honeypot system, traffic processing method, device, storage medium and program product. Background Technology

[0002] A honeypot is an attack deception system that uses a honeypot to simulate one or more vulnerable hosts and services, providing attackers with an easy target that is disguised as a user's application, making the attacker mistakenly believe that it is the target they want to attack.

[0003] Honeypots are a common intelligence gathering system widely used in the security field. Deploying honeypots is costly, requiring not only a host to run the service but also a significant amount of Internet Protocol (IP) addresses and common ports to disguise themselves as legitimate online hosts.

[0004] In a cloud computing environment, a dedicated private network can be created through a Virtual Private Cloud (VPC) network to achieve resource isolation and control. However, due to the isolation nature of VPC networks, deploying honeypot systems across VPC networks consumes significant resources. Summary of the Invention

[0005] This application provides a honeypot system, a traffic processing method, an apparatus, a storage medium, and a program product to reduce the resource consumption of a honeypot system across a VPC network.

[0006] In a first aspect, embodiments of this application provide a honeypot system, comprising: multiple virtual private networks; each virtual private network deploying at least one service node; the service node having a target port enabled for providing a target service to simulate an attacked object; the target service being different from the application service provided by the service node;

[0007] The honeypot system also includes a host security service node and a honeypot service system; the network where the host security service node and the honeypot service system are located is different from the multiple virtual private networks.

[0008] The service node is equipped with a host security proxy component; the host security proxy component is used to monitor the target port, and when an access request is detected on the target port, it forwards the access request to the host security service node.

[0009] The host security service node is used to forward the access request to the honeypot service system;

[0010] The honeypot service system is used to process the access request.

[0011] Secondly, embodiments of this application also provide a traffic processing method applicable to a host security proxy component deployed on a service node in a virtual private network; the service node has a target port enabled; the target port provides a target service to simulate an attacked object; the target service is different from the application service provided by the service node; the method includes:

[0012] Monitor the target port;

[0013] If an access request is detected at the target port, the access request is forwarded to the host security service node, which then forwards the access request to the honeypot service system for processing.

[0014] The host security service node and the honeypot service system are located on networks different from the virtual private network.

[0015] Thirdly, this application also provides a traffic processing method applicable to host security service nodes, the method comprising:

[0016] The system receives access requests forwarded by a host security proxy component; the host security proxy component is deployed on a service node in a virtual private network; the host security proxy component detects the access request from a target port of the service node; the target port provides a target service to simulate an attacked object; the target service is different from the application service provided by the service node.

[0017] The access request is forwarded to the honeypot service system for processing; wherein the network where the host security service node and the honeypot service system are located is different from the virtual private network.

[0018] Fourthly, embodiments of this application also provide a traffic processing method applicable to honeypot nodes, the method comprising:

[0019] The system receives an access request sent by a host security service node; the access request is sent by a host security proxy component on the service node in the virtual private network; the host security proxy component detects the access request from the target port of the service node; the target port provides a target service to simulate the attacked object; the target service is different from the application service provided by the service node.

[0020] If it is determined that the access request poses an attack risk, the access request is sent to the honeypot management node so that the honeypot management node can determine the risk information associated with the access request and output it.

[0021] The honeypot node, the honeypot management node, and the host security service node are located in networks different from the virtual private network.

[0022] Fifthly, embodiments of this application also provide a traffic processing method applicable to honeypot management nodes, the method comprising:

[0023] The system receives access requests sent by honeypot nodes; these access requests are sent by the host security proxy component on the service node in the virtual private network to the host security service node, and then forwarded by the host security service node to the honeypot node; the host security proxy component detects the access requests from the target port of the service node; the target port provides a target service to simulate the attacked object; the target service is different from the application service provided by the service node.

[0024] The risk information of the access request is determined and output; wherein the networks where the honeypot node, the honeypot management node and the host security service node are located are different from the virtual private network.

[0025] Sixthly, embodiments of this application also provide an electronic device, including: a memory and a processor; wherein the memory is used to store a computer program;

[0026] The processor is coupled to the memory for executing the computer program to perform steps in the traffic processing methods provided in the second, third, fourth, and / or fifth aspects.

[0027] In a seventh aspect, embodiments of this application also provide a computer-readable storage medium storing computer instructions that, when executed by one or more processors, cause the one or more processors to perform the steps in the traffic processing methods provided in the second, third, fourth, and / or fifth aspects.

[0028] Eighthly, embodiments of this application also provide a computer program product, including a computer program that, when executed by one or more processors, causes the one or more processors to perform the steps in the traffic processing methods provided in the second, third, fourth, and / or fifth aspects.

[0029] In this embodiment, the IP addresses and ports of service nodes providing normal application services within the VPC network are used to provide the target service, simulating the attacked object. This eliminates the need to deploy honeypot nodes separately in each VPC network, thus reducing the resource consumption of the honeypot system across VPC networks, such as network resources like IP addresses and ports. Since the target service used to lure attackers resides on the same service node as the application service, instead of being deployed separately, the computational resource consumption of the honeypot service is further reduced. Furthermore, by leveraging the client capabilities and traffic forwarding capabilities of the host security service, attack traffic is diverted to the honeypot service system, overcoming the isolation limitations of the VPC network and enabling honeypot traffic redirection across VPC network scenarios. Attached Figure Description

[0030] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0031] Figure 1 This is a schematic diagram of the architecture of a honeypot system in a traditional VPC network.

[0032] Figure 2 and Figure 3 This is a schematic diagram of the architecture of the honeypot system provided in the embodiments of this application;

[0033] Figure 4 , Figure 5 , Figure 6 and Figure 7 A schematic flowchart illustrating the traffic processing method provided in an embodiment of this application;

[0034] Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0035] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0036] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation portals are provided for users to choose to authorize or refuse.

[0037] The isolation inherent in Virtual Private Cloud (VPC) networks means that a single honeypot system cannot serve multiple VPC networks, requiring separate honeypot nodes to be deployed in each VPC network.

[0038] Specifically, such as Figure 1 As shown, at least one honeypot node is deployed in each VPC network. Each honeypot node occupies a separate service device, namely a cloud host. The honeypot node is the core component of the honeypot system, primarily used to mimic real systems or services to attract and capture attackers. Honeypot nodes are typically designed with low credibility to mislead attackers into believing they are easily compromised targets. Honeypot nodes can be used for: (1) enticing attackers by mimicking real systems and services to lure them into attacks, thereby consuming their resources and time; (2) collecting intelligence by recording attacker behavior, including the tools, methods, and targets used, providing valuable intelligence for security researchers; and (3) providing real-time alerts by immediately reporting to superiors upon detecting an attack, enabling timely countermeasures.

[0039] The honeypot management node is responsible for managing and coordinating the workflow of the entire honeypot system. It can be used for: (1) installing and configuring honeypot nodes, setting deception strategies and rules; (2) monitoring and analysis, collecting and analyzing data obtained from each honeypot node, and assessing the severity and potential impact of attacks; (3) response and recovery: developing and implementing corresponding emergency response and recovery plans based on the collected information; (4) reporting and auditing: generating detailed reports for the security team and other relevant personnel to refer to, and conducting regular audits to ensure the effectiveness and security of the honeypot system.

[0040] exist Figure 1 In this context, the user zone refers to the area where the service nodes for deploying user application services are located; the control zone refers to the area where the control devices for managing and controlling the service nodes are located.

[0041] exist Figure 1 In the honeypot system shown, attackers can launch attacks against the honeypot nodes. Specifically, attackers can send access requests to the honeypot nodes through their terminal devices to launch attacks on the honeypot nodes (corresponding to...). Figure 1Step 1 (“Attack”). The specific information carried in the access request depends on the purpose and type of the attack. Generally, the access request may carry authentication information, command and control information, malicious payload, and / or reconnaissance information, but is not limited to these. Authentication information is used to attempt to log in to the system or service and decrypt certain data or authentication mechanisms. Command and control information may include the command and control server address. Command information is used to remotely control the infected device, such as downloading malware or performing specific tasks. The control server address points to a server controlled by the attacker to receive further instructions. Malicious payload may be malware (such as viruses, Trojans, ransomware, etc.) or embedded scripts used to perform various operations. Reconnaissance information may include network scan data and / or system fingerprints. Network scan data may include port scan interfaces and / or vulnerability scan results. System fingerprints include operating system version, service information, etc., used for subsequent attack planning.

[0042] Honeypot nodes can perform risk detection on access requests and report access requests that are determined to pose an attack risk to the honeypot control node (corresponding to...). Figure 1 Step 2, “Reporting Risks,” involves the honeypot control node managing access requests to handle attack traffic.

[0043] However, Figure 1 The honeypot system shown requires at least one honeypot node to be deployed in each VPC network. This honeypot node consumes separate network resources within that VPC network, such as Internet Protocol (IP) addresses and ports. Furthermore, since the honeypot node is deployed on a separate service device within the VPC network, it also consumes the VPC network's computing resources. Therefore, Figure 1 The honeypot system shown has high resource consumption.

[0044] To address the high resource consumption of honeypot systems across VPC networks, some embodiments of this application utilize the IP addresses and ports of service nodes providing normal application services within the VPC network to provide target services and simulate attacked objects. This eliminates the need to deploy honeypot nodes separately in each VPC network, thus reducing the resource consumption of cross-VPC honeypot systems, such as network resources like IP addresses and ports. Furthermore, the target service used to lure attackers resides on the same service node as the application service, rather than being deployed separately, further reducing the computational resource consumption of the honeypot service. On the other hand, by leveraging the client capabilities and traffic forwarding capabilities of the host security service, attack traffic is diverted to the honeypot service system, overcoming the isolation limitations of the VPC network and enabling honeypot traffic redirection in cross-VPC network scenarios.

[0045] The technical solutions provided by the various embodiments of this application are described in detail below with reference to the accompanying drawings.

[0046] It should be noted that the same reference numerals denote the same object in the following figures and embodiments. Therefore, once an object is defined in one figure or embodiment, it does not need to be discussed further in subsequent figures and embodiments.

[0047] Figure 2 This is a schematic diagram of the architecture of a honeypot system provided in an embodiment of this application. Figure 2 As shown, the honeypot system includes multiple Virtual Private Cloud (VPC) networks. "Multiple" refers to two or more (including two). Figure 2 The illustration only shows two VPC networks (VPC-1 and VPC-2), but this is not intended to be limiting. Each VPC network has at least one service node 10 deployed.

[0048] Service node 10 deploys the application services required by the user, such as database services, security services, cloud communication services, cloud storage services, or cloud computing services, but is not limited to these. Service node 10 can be a single server device, a cloud-based server array, or a virtual machine (VM) running in a cloud-based server array. Alternatively, service node 10 can also refer to other computing devices with corresponding service capabilities, such as computer terminals (running service programs).

[0049] In this embodiment, service node 10 uses host security services to ensure host security. Host security provides system protection and hardening for the host, including security capabilities such as vulnerability detection and remediation, brute-force attacks, file detection, and malicious behavior detection, thus constructing a server security protection system. Host security services refer to a series of solutions and technologies designed to protect computer systems (i.e., hosts) from various security threats.

[0050] Host security services typically consist of two key components: a host security agent component (Agent) 20 and a host security service node (Server) 30. The host security agent component 20 is a software component installed on the client computer, responsible for monitoring and protecting the security status of the host. The host security agent component has the following functions: (1) Continuously monitoring system activity, including process startup, file access, and network connections, and detecting abnormal behavior; (2) Malware protection, using signature libraries and other technologies to identify and block the intrusion of malware such as viruses, Trojans, and worms; (3) Vulnerability assessment: Regularly checking for security vulnerabilities in the system and applications, and reporting issues that need to be fixed; (4) Firewall management: Controlling inbound and outbound traffic to prevent unauthorized access; (5) System hardening: Configuring system settings according to best practices to reduce the risk of attack; (6) Incident response: Responding quickly and taking action when a security incident is detected, such as isolating infected processes or files; (7) Log collection and analysis: Recording system activity logs and sending this data to the host security service node 30 for further analysis, etc.

[0051] The host security service node 30 is a centralized management platform, typically located in the cloud or on-premises data center, used to process data from multiple host security agent components 20 and provide a unified security policy management interface. The main functions of the host security service node 30 include: (1) Policy management: defining and implementing security policies, such as antivirus rules, firewall rules, etc., and pushing them to each host security agent component 20; (2) Log aggregation and analysis: collecting log data from all host security agent components 20, performing centralized analysis, and helping to identify potential security threats; (3) Alarms and notifications: generating alarms and notifying administrators via email, SMS, etc. when a security event is detected; (4) Reporting and compliance: generating detailed reports to help organizations meet compliance requirements and providing audit trails; (5) Automated response: automatically performing certain operations according to preset rules, such as isolating infected hosts, updating signature databases, etc.; (6) Central management interface: providing an intuitive user interface that allows administrators to easily view the security status of the entire network and make necessary adjustments.

[0052] In this embodiment, the host security proxy component 20 is deployed on a service node in a VPC network. The network where the host security service node 30 is located is different from the aforementioned multiple VPCs. The host security service node 30 is generally deployed in the cloud, i.e., in the internal network of a cloud service provider, and exposes the public IP address of the host security service to the outside world for users to use and access the host security service.

[0053] Since service node 10 uses a host security service to ensure host security, this service has client-side and traffic forwarding capabilities. The client-side function refers to deploying a host security proxy component 20 on the user's service node 10 as a client for the host security service. The traffic forwarding function means that the host security proxy component 20 can forward monitored traffic to the host security service node 30; the host security service node 30 can also forward traffic outwards. Based on this, the client-side function of the host security service can be used to capture attack traffic and achieve honeypot traffic redirection; and the traffic forwarding function of the host security service can be used to forward the captured attack traffic to the honeypot service system 40 for processing.

[0054] Based on this, in this embodiment, a target port can be started on service node 10. This target port serves as a honeypot port, providing target services to simulate the attacked object. To avoid port conflicts and reduce the impact of the honeypot service on the normal application services provided by the service node, the target port and the port providing the normal application services are different ports, and the target service provided by the target port is different from the normal application services provided by the service node. When an attacker launches an attack on the target service, they can send attack traffic to the target port of service node 10, that is, send access requests to the target port of service node 10 (corresponding to...). Figure 2 and Figure 3 Step 1, "Access Request").

[0055] Host security agent component 20 can monitor the target port (corresponding to) Figure 2 and Figure 3 Step 2, "Port Monitoring," involves forwarding the access request to the host security service node 30 (corresponding to...) upon detecting an access request on the target port. Figure 2 and Figure 3 (Step 3, "Access Request Forwarding"). In this embodiment, the access request can also be forwarded to the honeypot service system 40 by means of the forwarding function of the host security service node 30. The network where the honeypot service system 40 is located is different from the aforementioned multiple VPC networks; the honeypot service system 40 is located in the intranet of the cloud service provider that provides the honeypot service.

[0056] The honeypot service system 40 and the host security service node 30 can be located on the same intranet or on different intranets. Preferably, the honeypot service system 40 and the host security service node 30 are on the same intranet. Because when they are on the same intranet, the honeypot service system 40 can use the public IP address of the host security service without exposing its own public IP address. This way, since the honeypot service does not expose its own public IP address, attackers cannot use it to launch attacks, reducing the probability of attacks and improving its security. Furthermore, by using the public IP address of the host security service, users can access the honeypot service using the host security service's IP address, thus meeting their needs.

[0057] In this embodiment, the host security service node 30 can forward the access request to the honeypot service system 40 (corresponding to...). Figure 2 and Figure 3 Step 4, "Access Request Forwarding"). Specifically, as shown in step 4, "Access Request Forwarding". Figure 2 and Figure 3 As shown, the host security service node 30 can use its traffic forwarding module to forward access requests to the honeypot service system 40, thus diverting attack traffic to the honeypot service system 40. The honeypot service system 40 can then process the access requests.

[0058] In this embodiment, the IP addresses and ports of service nodes providing normal application services within the VPC network are used to provide the target service, simulating the attacked object. This eliminates the need to deploy honeypot nodes separately in each VPC network, thus reducing the resource consumption of the honeypot system across VPC networks, such as network resources like IP addresses and ports. Since the target service used to lure attackers resides on the same service node as the application service, instead of being deployed separately, the computational resource consumption of the honeypot service is further reduced. Furthermore, by leveraging the client capabilities and traffic forwarding capabilities of the host security service, attack traffic is diverted to the honeypot service system, overcoming the isolation limitations of the VPC network and enabling honeypot traffic redirection across VPC network scenarios.

[0059] In addition, the aforementioned Figure 1 In the honeypot system architecture shown, the honeypot nodes are deployed on independent cloud hosts, sharing different IP addresses from the application service cloud hosts. This results in a small deception exposure surface, raising the possibility that the application service system may be attacked while the honeypot remains unaffected. In this embodiment, the IP address and port of the service node (i.e., the cloud host) where the application service resides are used. Since the target service and application service are on the same service node, the deception exposure surface is increased, reducing the likelihood that the application service system may be attacked while the honeypot remains unaffected.

[0060] To reduce the cost of modifying the architecture of a honeypot service system, the traditional honeypot service system architecture can be reused, specifically the architecture of the honeypot nodes and honeypot management nodes. For example... Figure 3 As shown in this embodiment, the honeypot service system 40 may include a honeypot node 40a and a honeypot management node 40b. The honeypot node 40a and the honeypot management node 40b are located in the same intranet, but are different from the aforementioned multiple VPC networks. For a description of the role and function of the honeypot node and the honeypot management node 40b, please refer to the relevant content in the foregoing embodiments, which will not be repeated here.

[0061] In this embodiment, honeypot node 40a can expose its port to host security service node 30, so that host security service node 30 can forward access traffic to the port of honeypot node 40a (corresponding to...). Figure 3 Step 4, "Access Request Forwarding," forwards access traffic to the honeypot service system 40. Honeypot node 40a can then forward access requests to the honeypot management node 40b (corresponding to...) if the access request poses an attack risk. Figure 3 Step 5, "Reporting Risks".

[0062] In some embodiments, since the target port is used to capture or spoof attack traffic, normal traffic generally does not access this target port. Therefore, access requests detected by the host security proxy component 20 on the target port can be directly considered as attack traffic. Thus, the honeypot node 40a can directly identify access requests forwarded by the host security service node 30 as access requests with attack risks.

[0063] In other embodiments, risk detection rules can be pre-configured in honeypot node 40a. If honeypot node 40a determines that an access request matches a risk detection rule, it determines that the access request poses an attack risk. In this embodiment, the specific implementation of the risk detection rules is not limited. In some embodiments, allowed lists can be pre-configured in honeypot node 40a. These allowed lists may include IP addresses whose requests are considered safe traffic. Based on this, honeypot node 40a can perform risk detection on access requests according to the pre-defined allowed lists; if the source IP address of the access request does not exist in the allowed lists, it determines that the access request poses an attack risk. Using allowed lists for risk detection can reduce the false positive rate. Allowed lists ensure that legitimate requests are not interfered with.

[0064] In other embodiments, clue data is collected in advance. This clue data includes attribute information of requests identified as having an attack risk. Clue data may include, but is not limited to, one or more of the following: user feedback or complaint data, interception data from a risk control system, and network security intelligence data. "Multiple" refers to two or more types. The request attribute information may include the identifier of the user to whom the request belongs and the network quaternion of the request. The network quaternion includes: source IP address and source port, and destination IP address and destination port. Accordingly, risk detection can be performed on access requests based on the pre-collected clue data; if the attribute information of the access request matches the attribute information of requests identified as having an attack risk contained in the aforementioned clue data, then the access request is determined to have an attack risk. Wherein, the matching of the access request attribute information with the attribute information of requests identified as having an attack risk contained in the aforementioned clue data can be implemented as follows: the user identifier of the access request is the same as the user identifier of the request identified as having an attack risk, and / or, all or part of the network quaternion of the access request is the same as the network quaternion of the request identified as having an attack risk. Specifically, the matching of a portion of the network four-tuple of an access request with that of a request identified as having an attack risk can be achieved by either: the source IP address and source port of the access request being the same as those of the request identified as having an attack risk, or vice versa. Utilizing historical data for risk detection can reduce the false positive rate. Historical data provides a more accurate basis for risk assessment, preventing legitimate access requests from being mistakenly identified as attack requests.

[0065] The method by which honeypot node 40a performs risk detection on access requests as illustrated in the foregoing embodiments is merely illustrative and does not constitute a limitation. Furthermore, if honeypot node 40a determines that an access request poses an attack risk, it forwards the access request to honeypot management node 40b. Honeypot management node 40b can then determine the risk information of the access request.

[0066] In this embodiment, the specific content of the risk information determined by the honeypot management node 40b is not limited. In some embodiments, the honeypot management node 40b can obtain the attribute information of the target service node of the access request attack. The attribute information of the target service node refers to the basic information of the target service node, which may include one or more of the following: the service node's identity identifier (i.e., a unique identifier used to distinguish different hosts), IP address, the hostname corresponding to the service node (the name of the host in the network), the VPC network to which the service node belongs, and the user to which the service node belongs. "Multiple" refers to two or more (including two).

[0067] Host security service node 30 manages the attribute information of service nodes. For example... Figure 3As shown, the asset management module in the host security service node 30 is used to manage the attribute information of the service node. To enable the honeypot control node 40b to accurately identify the attribute information of the target service node attacked by the access request from the host security service node 30, in some embodiments of this application, the host security proxy component 20 carries its identifier in the access request when forwarding it to the host security service node. The identifier of the host security proxy component 20 refers to information that uniquely identifies a host security proxy component 20, and can be a Universally Unique Identifier (UUID) for the host security proxy component 20. UUID is a technology used to generate unique identifiers, designed to ensure that identifiers generated in a distributed network environment are unique.

[0068] Furthermore, the host security proxy component 20 can forward access requests carrying the identifier of the host security proxy component to the host security service node 30. The host security service node 30 then forwards the access requests carrying the identifier of the host security proxy component to the port of the honeypot node 40a. If the access request poses an attack risk, the honeypot node 40a will send the access request carrying the identifier of the host security proxy component to the honeypot management node 40b.

[0069] Since each service node 10 deploys a host security proxy component 20, and each host security proxy component 20 has a unique identifier, there is a one-to-one correspondence between the identifier of the host security proxy component 20 and the service node. Based on this, the honeypot control node 40b can obtain the attribute information (corresponding to) the target service node attacked by the access request from the host security service node 30 according to the identifier of the host security proxy component 20. Figure 3 (Step 6, "Asset Integration"). Further, based on the target service node's attribute information and / or access request, the risk information of the access request can be determined.

[0070] In some embodiments, the honeypot management node 40b can record attack events on access requests to obtain risk information about the access requests. This risk information may include: the recorded attack time, source IP address, attack method, and number of attacks within a certain time period.

[0071] Honeypot management node 40b can also determine the severity and potential impact of an attack based on the attack method of the access request; and determine the risk level based on the severity and potential impact of the attack, and use the risk level as risk information.

[0072] The honeypot management node 40b can also determine the asset information of the access request attack based on the attribute information of the target service node, as the risk information of the access request. This asset information may include the IP address, hostname, and user ID of the target service node.

[0073] The implementation method and specific content of the honeypot control node 40b in determining the risk information of access requests shown in the foregoing embodiments are merely illustrative and do not constitute a limitation.

[0074] After identifying the risk information of the access request, the honeypot management node 40b can output the risk information, thereby informing the user of the attack risk. Optionally, the honeypot management node 40b can send the risk information of the access request to the user to whom the target service node belongs. For example, the honeypot management node 40b can send the risk information of the access request to the terminal device of the user to whom the target service node belongs via telephone, SMS, email, and / or instant messaging, so that the user to whom the target service node belongs can be aware of the potential attack risk in a timely manner and take timely defense measures.

[0075] In addition to providing a honeypot system, this application also provides a corresponding traffic processing method. The traffic processing method provided in this application is illustrated below from the perspectives of the host security proxy component deployed in the service node, the host security service node, the honeypot node, and the honeypot management node.

[0076] Figure 4 and Figure 5 This is a schematic flowchart of the traffic processing method provided in an embodiment of this application. Figure 4 The provided traffic processing methods are primarily applicable to host security proxy components deployed on service nodes in VPC networks. Figure 5 The provided traffic processing method is primarily applicable to host security service nodes. Specifically, the service node starts with a target port; the target port provides a target service to simulate a target being attacked; the target service differs from the application service provided by the service node. For example... Figure 4 As shown, the traffic processing methods performed by the host security proxy component mainly include:

[0077] 401. Monitor the target port.

[0078] 402. If an access request is detected on the target port, the access request is forwarded to the host security service node, which then forwards the access request to the honeypot service system for processing.

[0079] like Figure 5 As shown, the traffic processing methods performed by the host security service node mainly include:

[0080] 501. Receive access requests forwarded by the host security proxy component.

[0081] 502. Forward the access request to the honeypot service system for processing.

[0082] In this embodiment, the service node starts a target port, which serves as a honeypot port, providing a target service to simulate the attacked object. To avoid port conflicts and reduce the impact of the honeypot service on the normal application services provided by the service node, the target port and the port providing the normal application service are different ports, and the target service provided by the target port is different from the normal application service provided by the service node. When an attacker launches an attack on the target service, they can send attack traffic to the target port of the service node, that is, send access requests to the target port of the service node.

[0083] Based on this, in step 401, the host security proxy component can monitor the target port, and if an access request is detected on the target port, in step 402, it forwards the access request to the host security service node. In this embodiment, the access request can also be forwarded to the honeypot service system using the forwarding function of the host security service node. The honeypot service system is located in a network different from the aforementioned VPC network; it resides within the intranet of the cloud service provider offering the honeypot service.

[0084] The honeypot service system and the host security service node can be located on the same intranet or on different intranets. Preferably, the honeypot service system and the host security service node are on the same intranet. Because when they are on the same intranet, the honeypot service system can use the public IP address of the host security service without exposing its own public IP address. This prevents attackers from using the honeypot service's public IP address to launch attacks, reducing the probability of attacks and improving the honeypot service's security. Furthermore, by using the host security service's public IP address, users can also use the host security service's IP address to access the honeypot service, fulfilling their needs.

[0085] In the embodiments of this application, such as Figure 5 As shown in step 501, the host security service node can receive access requests forwarded by the host security proxy component; and in step 502, it forwards the access request to the honeypot service system, diverting attack traffic to the honeypot service system. The honeypot service system can process the access request.

[0086] In this embodiment, the IP addresses and ports of service nodes providing normal application services within the VPC network are used to provide the target service, simulating the attacked object. This eliminates the need to deploy honeypot nodes separately in each VPC network, thus reducing the resource consumption of the honeypot system across VPC networks, such as network resources like IP addresses and ports. Since the target service used to lure attackers resides on the same service node as the application service, instead of being deployed separately, the computational resource consumption of the honeypot service is further reduced. Furthermore, by leveraging the client capabilities and traffic forwarding capabilities of the host security service, attack traffic is diverted to the honeypot service system, overcoming the isolation limitations of the VPC network and enabling honeypot traffic redirection across VPC network scenarios.

[0087] In addition, the aforementioned Figure 1 In the honeypot system architecture shown, the honeypot nodes are deployed on independent cloud hosts, sharing different IP addresses from the application service cloud hosts. This results in a small deception exposure surface, raising the possibility that the application service system may be attacked while the honeypot remains unaffected. In this embodiment, the IP address and port of the service node (i.e., the cloud host) where the application service resides are used. Since the target service and application service are on the same service node, the deception exposure surface is increased, reducing the likelihood that the application service system may be attacked while the honeypot remains unaffected.

[0088] To reduce the cost of modifying the honeypot service system architecture, the traditional honeypot service system architecture can be reused, specifically the architecture of the honeypot nodes and honeypot management nodes. The honeypot nodes and honeypot management nodes 40b are located in the same internal network, but in a different network than the aforementioned VPC network.

[0089] In this embodiment, the honeypot node can expose its port to the host security service node. In this way, the host security service node can forward access traffic to the port of the honeypot node, thereby forwarding access traffic to the honeypot service system.

[0090] Accordingly, the traffic processing methods implemented for honeypot nodes mainly include: Figure 6 The following steps are shown:

[0091] 601. Receive access requests sent by the host security service node.

[0092] 602. If an access request is determined to pose an attack risk, the access request is sent to the honeypot management node so that the honeypot management node can determine the risk information associated with the access request and output it.

[0093] For honeypot nodes, if there is an attack risk in the access request, the access request can be sent to the honeypot management node.

[0094] In some embodiments, since the target port is used to capture or spoof attack traffic, normal traffic generally does not access this target port. Therefore, access requests detected by the host security proxy component on the target port can be directly considered as attack traffic. Thus, access requests forwarded by the host security service node can be directly identified as access requests with attack risks.

[0095] In other embodiments, risk detection rules can be pre-configured in the honeypot node. If an access request matches a risk detection rule, the access request is determined to pose an attack risk. In this application, the specific implementation of the risk detection rules is not limited. In some embodiments, an allowed list can be pre-configured in the honeypot node. This allowed list may include IP addresses whose requests are considered safe traffic. Based on this, access requests can be risk-detected according to the pre-defined allowed list; if the source IP address of the access request does not exist in the allowed list, the access request is determined to pose an attack risk.

[0096] In other embodiments, clue data is collected in advance. Based on the pre-collected clue data, access requests can be subjected to risk detection; if the attribute information of the access request matches the attribute information of requests identified as having an attack risk in the aforementioned clue data, then the access request is determined to have an attack risk.

[0097] The method for honeypot nodes to detect risks in access requests, as illustrated in the foregoing embodiments, is merely illustrative and does not constitute a limitation. Furthermore, if a honeypot node determines that an access request poses an attack risk, it forwards the request to a honeypot management node for traffic processing. Figure 7 A flowchart illustrating the traffic processing for honeypot control nodes. (Example) Figure 7 As shown, the main steps include:

[0098] 701. Receive access requests sent by honeypot nodes.

[0099] 702. Determine the risk information of the access request.

[0100] 703. Output risk information.

[0101] The honeypot management node can determine the risk information of the access request. In this embodiment, the specific content of the risk information determined by the honeypot management node is not limited. In some embodiments, the honeypot management node can obtain the attribute information of the target service node attacked by the access request.

[0102] The host security service node management system contains attribute information about the service nodes. To enable the honeypot control node to accurately identify the attribute information of the target service node attacked by the access request from the host security service node, in some embodiments of this application, the host security proxy component carries its identifier in the access request when forwarding it to the host security service node.

[0103] Furthermore, the host security proxy component can forward access requests carrying its identifier to the host security service node. The host security service node then forwards the access requests carrying the host security proxy component's identifier to the honeypot node's port. If the access request poses an attack risk, the honeypot node will send the access request carrying the host security proxy component's identifier to the honeypot management node.

[0104] Since each service node deploys a host security proxy component, and each host security proxy component has a unique identifier, there is a one-to-one correspondence between the identifier of the host security proxy component and the service node. Based on this, the honeypot management node can obtain the attribute information of the target service node attacked by the access request from the host security service node according to the identifier of the host security proxy component. Furthermore, the risk information of the access request can be determined based on the attribute information of the target service node and / or the access request. For specific implementation methods for determining the risk information of the access request, please refer to the relevant content of the foregoing embodiments, which will not be repeated here.

[0105] After identifying the risk information of the access request, the risk information of the access request can be output, thereby informing the user of the attack risk of the access request, so that the user of the target service node can be aware of the potential attack risk in a timely manner and take timely defense measures.

[0106] It should be noted that the execution subject of each step of the method provided in the above embodiments can be the same device, or the method can be executed by different devices. For example, the execution subject of steps 401 and 402 can be device A; or the execution subject of step 401 can be device A, and the execution subject of step 402 can be device B; and so on.

[0107] Furthermore, some processes described in the above embodiments and accompanying drawings include multiple operations that appear in a specific order. However, it should be clearly understood that these operations may not be executed in the order they appear herein, or they may be executed in parallel. The operation numbers, such as 401, 402, etc., are merely used to distinguish different operations and do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed sequentially or in parallel.

[0108] Accordingly, embodiments of this application also provide a computer-readable storage medium storing computer instructions, which, when executed by one or more processors, cause one or more processors to perform the steps in the traffic processing methods provided in the foregoing embodiments.

[0109] This application also provides a computer program product, including a computer program that, when executed by one or more processors, causes the one or more processors to perform the steps in the traffic processing methods provided in the aforementioned embodiments. In this application, the specific implementation of the computer program product is not limited. In some embodiments, the computer program product may be implemented as an application (APP), a mini-program, a PC client, a program module, a plug-in, an installation package, a software development kit (SDK), an optical disc image file (such as an ISO file), a plug-in, or software in the form of Software as a Service (SaaS), etc., but is not limited thereto.

[0110] Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 8 As shown, the electronic device includes a memory 80a and a processor 80b. The memory 80a is used to store computer programs.

[0111] The processor 80b is coupled to the memory 80a and is used to execute a computer program to perform the steps in the traffic processing methods provided in the foregoing embodiments. Specific implementation details of each step can be found in the relevant descriptions of the foregoing embodiments, and will not be repeated here.

[0112] In some alternative implementations, such as Figure 8 As shown, the electronic device may also include optional components such as a communication component 80c, a power supply component 80d, a display component 80e, and an audio component 80f. Figure 8 The diagram only shows some components and does not mean that the electronic device must contain them. Figure 8 The inclusion of all components does not imply that an electronic device can only include... Figure 8 The components shown.

[0113] in addition, Figure 8 The components within the dashed box are optional, not mandatory, and their specific requirements depend on the form factor of the electronic device. The electronic device in this embodiment can be a desktop computer, laptop computer, mobile phone, or IoT device; it can also be a traditional server, cloud server, or server cluster, or other server equipment.

[0114] In this embodiment, the memory is used to store computer programs and can be configured to store various other data to support operation on its host device. The processor can execute the computer programs stored in the memory to implement corresponding control logic. The memory can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random-Access Memory (SRAM), Electrically Erasable Programmable Read Only Memory (EEPROM), Electrically Programmable Read Only Memory (EPROM), Programmable Read Only Memory (PROM), Read Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0115] In the embodiments of this application, the processor can be any hardware processing device capable of executing the above-described method logic. Optionally, the processor can be a central processing unit (CPU), a graphics processing unit (GPU), or a microcontroller unit (MCU); it can also be a field-programmable gate array (FPGA), a programmable array logic (PAL), a general array logic (GAL), a complex programmable logic device (CPLD), or other programmable devices; or it can be an advanced RISC machine (ARM) or a system on chip (SoC), etc., but is not limited thereto.

[0116] In this embodiment, the communication component is configured to facilitate wired or wireless communication between its host device and other devices. The device housing the communication component can access wireless networks based on communication standards, such as Wireless Fidelity (WiFi), 2G or 3G, 4G, 5G, or combinations thereof. In one exemplary embodiment, the communication component receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In another exemplary embodiment, the communication component may also be implemented based on Near Field Communication (NFC), Radio Frequency Identification (RFID), Infrared Data Association (IrDA), Ultra Wide Band (UWB), Bluetooth (BT), or other technologies.

[0117] In embodiments of this application, the display component may include a liquid crystal display (LCD) and a touch panel (TP). If the display component includes a touch panel, the display component can be implemented as a touchscreen to receive input signals from a user. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensors can sense not only the boundaries of touch or swipe actions but also the duration and pressure associated with the touch or swipe operation.

[0118] In this embodiment, a power supply component is configured to provide power to various components of the device in which it resides. The power supply component may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the device in which the power supply component resides.

[0119] In embodiments of this application, the audio component can be configured to output and / or input audio signals. For example, the audio component includes a microphone (MIC), which is configured to receive external audio signals when the device containing the audio component is in an operating mode, such as call mode, recording mode, and voice recognition mode. The received audio signals can be further stored in memory or transmitted via a communication component. In some embodiments, the audio component also includes a speaker for outputting audio signals. For example, in devices with voice interaction capabilities, voice interaction with the user can be achieved through the audio component.

[0120] It should be noted that the terms "first" and "second" in this article are used to distinguish different messages, devices, modules, etc., and do not represent a chronological order, nor do they limit "first" and "second" to different types.

[0121] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, compact disc read-only memory (CD-ROM), optical storage, etc.) containing computer-usable program code.

[0122] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0123] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0124] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0125] In a typical configuration, a computing device includes one or more processors (CPU, etc.), input / output interfaces, network interfaces, and memory.

[0126] Memory may include non-persistent storage in computer-readable media, such as random-access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0127] Computer storage media are readable storage media, also known as removable media. Removable and non-removable media can be used to store information by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, Digital Video Disc (DVD) or other optical storage, magnetic tape, disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient media, such as modulated data signals and carrier waves.

[0128] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes the aforementioned element.

[0129] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A honeypot system, characterized in that, include: Multiple Virtual Private Networks; Each virtual private network (VPN) is deployed with at least one service node; the service node has a target port enabled to provide a target service to simulate the target being attacked; the target service is different from the application service provided by the service node. The honeypot system also includes a host security service node and a honeypot service system; the network where the host security service node and the honeypot service system are located is different from the multiple virtual private networks. The service node is equipped with a host security proxy component. The host security proxy component is used to monitor the target port, and when an access request is detected on the target port, it forwards the access request to the host security service node. The host security service node is used to forward the access request to the honeypot service system; The honeypot service system is used to process the access request.

2. The system according to claim 1, characterized in that, The honeypot service system includes: honeypot nodes and honeypot management nodes; the honeypot nodes expose ports to the host security service nodes. The host security service node is used to forward the access request to the port of the honeypot node; When processing the access request, the honeypot service system specifically uses the following methods: The honeypot node is used to send the access request to the honeypot management node if the access request is at risk of being attacked. The honeypot management node is used to determine the risk information associated with the access request and output the risk information.

3. The system according to claim 1 or 2, characterized in that, The host security service node and the honeypot service system are located on the same internal network, and the Internet Protocol address of the host security service node is exposed to the outside world.

4. A traffic processing method, applicable to a host security proxy component deployed on a service node in a virtual private network; characterized in that, The service node is started with a target port; The target port provides the target service to simulate the attacked object; The target service is different from the application service provided by the service node; the method includes: Monitor the target port; If an access request is detected at the target port, the access request is forwarded to the host security service node, which then forwards the access request to the honeypot service system for processing. The host security service node and the honeypot service system are located on networks different from the virtual private network.

5. The method according to claim 4, characterized in that, Forwarding the access request to the host security service node includes: The identifier of the host security agent component is included in the access request; The access request carrying the identifier of the host security proxy component is forwarded to the host security service node, so that the host security service node can forward the access request carrying the identifier of the host security proxy component to the honeypot service system for processing.

6. A traffic processing method, applicable to host security service nodes, characterized in that, The method includes: The system receives access requests forwarded by a host security proxy component; the host security proxy component is deployed on a service node in a virtual private network; the host security proxy component is used to monitor the access request from a target port of the service node; the target port provides a target service to simulate an attacked object; the target service is different from the application service provided by the service node. The access request is forwarded to the honeypot service system for processing; wherein the network where the host security service node and the honeypot service system are located is different from the virtual private network.

7. A traffic processing method applicable to honeypot nodes, characterized in that, The method includes: The system receives an access request sent by a host security service node; the access request is sent by a host security proxy component on the service node in the virtual private network; the host security proxy component is used to monitor the access request from the target port of the service node; the target port provides a target service to simulate the attacked object; the target service is different from the application service provided by the service node. If it is determined that the access request poses an attack risk, the access request is sent to the honeypot management node so that the honeypot management node can determine the risk information associated with the access request and output it. The honeypot node, the honeypot management node, and the host security service node are located in networks different from the virtual private network.

8. The method according to claim 7, characterized in that, The method further includes: The received access request was determined to pose an attack risk; or, Based on a preset permitted list, the access request is subjected to risk detection; if the source Internet Protocol address of the access request does not exist in the permitted list, it is determined that the access request poses an attack risk. or, Based on pre-collected clue data, the access request is subjected to risk detection; the clue data includes attribute information of requests identified as having an attack risk; if the attribute information of the access request matches the attribute information of the request with an attack risk, then the access request is determined to have an attack risk.

9. A traffic processing method, applicable to honeypot control nodes, characterized in that, The method includes: The system receives access requests sent by honeypot nodes; these access requests are sent by a host security proxy component on a service node in the virtual private network to a host security service node, and then forwarded by the host security service node to the honeypot node; the host security proxy component is used to monitor the access requests from the target port of the service node; the target port provides a target service to simulate the attacked object; the target service is different from the application service provided by the service node. The risk information of the access request is determined and output; wherein the networks where the honeypot node, the honeypot management node and the host security service node are located are different from the virtual private network.

10. The method according to claim 9, characterized in that, The access request carries the identifier of the host security proxy component; determining the risk information of the access request includes: Based on the identifier of the host security proxy component, obtain the attribute information of the service node of the access request attack from the host security service node; The risk information is determined based on the attribute information of the service node attacked by the access request and the access request itself.

11. An electronic device, characterized in that, include: A memory and a processor; wherein the memory is used to store computer programs; The processor is coupled to the memory for executing the computer program to perform the steps of the method according to any one of claims 4-10.

12. A computer-readable storage medium storing computer instructions, characterized in that, When the computer instructions are executed by one or more processors, the one or more processors are caused to perform the steps of the method according to any one of claims 4-10.

13. A computer program product, characterized in that, Includes a computer program that, when executed by one or more processors, causes the one or more processors to perform the steps of the method according to any one of claims 4-10.

Images