Method for creating a honeypot

Abstract

According to various embodiments, a method for generating a honeypot for a target system is described, comprising training a machine learning model, outputting a honeypot configuration appropriate to the input (i.e., for a textually specified target system to be imitated by a honeypot) in response to an input (i.e., an input on which the machine learning model is trained) containing a textual target system specification, receiving a textual specification of the target system, feeding the received textual specification to the trained machine learning model, and generating a honeypot according to the configuration that the machine learning model outputs in response to the input of the received textual specification.

Description

[0001] The present disclosure relates to methods for creating a honeypot.

[0002] The number of networked data processing devices (including embedded devices) is increasing rapidly. A crucial aspect of all these devices—whether server computers on the internet or control units in the automotive or IoT sectors—is product security. Honeypots are decoys that mimic such valuable (target) systems to attract attackers and gather information about their attack strategies and objectives. Honeypots are an established threat analysis tool, particularly in enterprise IT, and are now also being used in the (Industrial) Internet of Things (IoT). While honeypots are a very useful tool for complementing cybersecurity strategies, their implementation for specific needs and target systems requires significant manual work by experts.

[0003] Therefore, approaches that allow for simpler deployment (especially configuration) of a suitable honeypot for a given target system are desirable.

[0004] According to various embodiments, a method for generating a honeypot for a target system is provided, comprising training a machine learning model, in response to an input (i.e., an input on which the machine learning model is trained) containing a textual target system specification, outputting a honeypot configuration appropriate to the input (i.e., for a textually specified target system to be imitated by a honeypot, outputting a suitable configuration for such a honeypot), receiving a textual specification of the target system, feeding the received textual specification to the trained machine learning model, and generating a honeypot according to the configuration that the machine learning model outputs in response to the input of the received textual specification.

[0005] The method described above enables a suitable honeypot generation facility to automatically create honeypot implementations for specific needs. The honeypot environment is derived from written system specifications, which can be of various types: standardization documents (such as RFCs), internal (specific) specifications, or vendor-specific specifications. These specifications are not statically cloned, but rather interpreted (by the machine learning model) to create a dynamic honeypot environment. This makes it possible to create a honeypot for completely different systems and protocols without cloning existing content, but instead using a description to derive a honeypot.Furthermore, the method described above enables the automation of honeypot development and configuration for non-cybersecurity personnel, reducing the required expertise for setting up honeypots (which is difficult to find) and making it possible to increase the overall security of a product or service, since honeypots can be set up automatically and thus at least a minimum number of honeypots can be set up with little effort.

[0006] In various implementations, a complete honeypot design is automatically derived from system specifications. This not only automates work steps but, in particular, enables users who are not cybersecurity experts to build honeypot systems.

[0007] The following are various examples of implementation.

[0008] Exemplary embodiment 1 is a method for creating a honeypot, as described above.

[0009] Embodiment 2 is the method according to embodiment 1, comprising, before feeding the received textual specification to the trained machine learning model, removing data from the textual specification that must be kept secret according to a confidentiality criterion.

[0010] For example, sensitive data can be removed from a product description before it is fed into the machine learning model. This ensures that the output of the machine learning model is free of such sensitive data that could otherwise be reflected in the output. This can also be done for the input data of training examples to prevent sensitive data from being reflected in the parameters (and ultimately in the output) of the machine learning model (i.e., to prevent information about it from being gleaned).

[0011] Embodiment 3 is the method according to embodiment 1 or 2, wherein the input on which the machine learning model is trained and the received textual specification each contain a (textual) indication of services and / or protocols to be supported by the respective honeypot and / or one or more operating systems to be supported.

[0012] These are typically important properties or functionalities of a target system that a honeypot is intended to imitate.

[0013] Exemplary embodiment 4 is the method according to one of the exemplary embodiments 1 to 3, comprising evaluating the generated honeypot (e.g., for real attacks or automated test procedures (e.g., scans), whether the honeypot reacts like the target system) and updating the machine learning model according to the evaluation.

[0014] The machine learning model can therefore be successively improved using one or more honeypots created with it.

[0015] Exemplary embodiment 5 is the method according to one of the exemplary embodiments 1 to 4, wherein the input on which the machine learning model is trained contains information in the form of a result of a static rule and wherein the static rule is applied to the received textual specification (and possibly additional information) and the received textual specification together with the result of the application is fed to the machine learning model.

[0016] Static rules (i.e., predefined rules that do not change during the training of the machine learning model) for determining the configuration can also be combined with the machine learning model. This could, for example, be a fixed rule specifying which version of honeypot software should be used (depending on the target system).

[0017] Alternatively, the output of the machine learning model can be supplemented with the result of applying such a static rule before a honeypot is created accordingly.

[0018] Exemplary embodiment 6 is the method according to one of the exemplary embodiments 1 to 5, wherein the input on which the machine learning model is trained contains at least one Boolean expression of target system functionalities and / or target system properties, and wherein at least one Boolean expression is determined from the received textual specification (and possibly additional information) and is supplied to the machine learning model together with the received textual specification.

[0019] The formation of Boolean expressions facilitates processing by the machine learning model.

[0020] Embodiment 7 is the method according to one of embodiments 1 to 6, wherein the machine learning model is a Large Language Model.

[0021] This enables effective processing of textual data, in this case the specification of the target system.

[0022] Exemplary embodiment 8 is a data processing system with a honeypot generation device that is configured to carry out the method according to one of the exemplary embodiments 1 to 7.

[0023] Exemplary embodiment 9 is the computer program with instructions which, when executed by a processor, cause the processor to perform a method according to one of the exemplary embodiments 1 to 7.

[0024] Embodiment 10 is a computer-readable medium that stores instructions which, when executed by a processor, cause the processor to perform a method according to one of embodiments 1 to 7.

[0025] In the drawings, similar reference numerals generally refer to the same parts in all the different views. The drawings are not necessarily to scale, with the emphasis generally placed on illustrating the principles of the invention. Various aspects are described in the following description with reference to the drawings. Fig. Figure 1 shows a computer network. Fig. Figure 2 illustrates the configuration of a honeypot according to one embodiment. Fig. Figure 3 shows a flowchart illustrating a method for creating a honeypot for a target system according to one embodiment.

[0026] The following detailed description refers to the accompanying drawings, which illustrate specific details and aspects of this disclosure in which the invention can be implemented. Other aspects may be used, and structural, logical, and electrical modifications may be made without deviating from the scope of the invention. The various aspects of this disclosure are not necessarily mutually exclusive, as some aspects of this disclosure may be combined with one or more other aspects of this disclosure to form new aspects.

[0027] Several examples are described in more detail below.

[0028] Fig. Figure 1 shows a computer network 100. The computer network 100 contains a variety of data processing devices 101-104, which are interconnected by communication links 106. The data processing devices 101-104 include, for example, server computers 101 and control units 102, as well as user terminals 103, 104.

[0029] Server computers 101 provide various services, such as websites, banking portals, etc. A control unit 102, for example, is a control device for a robotic device, such as a control unit in an autonomous vehicle. Server computers 101 and control units 102 thus fulfill different tasks, and typically, a user terminal device 103 or 104 can access a server computer 101 or a control unit 102. This is particularly the case when a server computer 101 offers a user functionality, such as a banking portal. However, a control unit 102 can also allow external access (e.g., for configuration). Depending on their task, server computers 101 and control units 102 can store security-relevant data and perform security-relevant tasks. Accordingly, they must be protected against attackers.For example, an attacker using one of the user terminal devices 104 could, through a successful attack, obtain secret data (such as keys), manipulate accounts, or even manipulate a control unit 102 in such a way that an accident occurs.

[0030] One security measure against such attacks is a so-called honeypot 106 (implemented by one of the data processing devices 105). It ostensibly provides functionality and thus serves as bait to attract potential attackers. However, it is isolated from confidential information or critical functionality, so that attacks against it occur in a controlled environment and the risk of impairing the actual functionality is minimized. This allows for the acquisition of information about attacks on a target system (e.g., one of the server computers 101 or one of the control units 106), which can then be addressed by implementing appropriate measures on the target system without endangering the target system itself.

[0031] However, setting up a honeypot for a specific (target) system (e.g., a server computer 101 or a control unit 102) in such a way that it is credible to potential attackers and actually provokes attacks on it is not easy and requires experience and / or detailed knowledge of honeypots and a great deal of effort.

[0032] According to various embodiments, an approach is therefore provided that makes it possible to automatically derive a honeypot from a technical, written system specification without having special knowledge about honeypots.

[0033] Fig. Figure 2 illustrates the configuration of a honeypot according to one embodiment.

[0034] The configuration is carried out by a honeypot configuration device 200, which corresponds, for example, to one of the user terminal devices 106 (e.g., a computer with which a user (such as a system administrator) configures the honeypot 106 and instructs the data processing device 105 to provide the honeypot 106 thus configured).

[0035] First, a formal written system specification WSS, a manufacturer specification VS or an informal written description IFW is determined (e.g. received) or provided (e.g. via an input interface 202 of the honeypot configuration device 200) by a target system, e.g. an embedded control unit 102.

[0036] The specification is then evaluated by an evaluation unit 201 of the honeypot configuration device 200. The evaluation is performed by a machine learning model 204, in Fig. 2 denoted by MLA, (e.g. a large language model) and supported by one or more static rule sets RLS (e.g. for pattern recognition), Boolean expressions BE and / or any heuristic or deterministic procedure P for selecting suitable honeypots.

[0037] The result of the evaluation is a honeypot configuration for a specific honeypot architecture and possible implementation variants. The evaluation unit 201 selects the configuration (and, if necessary, the honeypot architecture) such that the implemented honeypot 203 correctly replicates the selected target system and the honeypot itself is securely implemented and configured. The honeypot configuration unit 200 then initiates the deployment, i.e., the implementation, of the honeypot (e.g., honeypot 106 on the data processing device 105).

[0038] Evaluation Unit 201 thus receives a written system specification of the target system. This specification can be of various types, such as a standardized system specification (i.e., a system specification issued by a standards body, e.g., an RFC (Request for Comments) document), a customer-specific specification, a manufacturer's specification, or a combination thereof. Since the specification contains information about the system services, the operating system, and other properties of the target system, Evaluation Unit 201 is able not only to select a suitable honeypot architecture but also to configure the honeypot, for example, by choosing a specific implementation variant.

[0039] The evaluation unit 201 can interpret the given system specification of the target system in various ways, regardless of its form: According to various embodiments, the evaluation unit 201 uses a machine learning model (MAL) that receives (at least) the specification of the target system as input and is trained to determine a honeypot configuration for a honeypot architecture (and optionally also a specification of the honeypot architecture) from its input. For example, the machine learning model 204 is a large language model that can interpret the specification text and suggest a possible solution. Since honeypots are a cybersecurity issue, such models must meet security requirements in order to automatically select and configure honeypots. Determining the configuration (and possibly the honeypot architecture) can be supplemented by • Interpretation of the target system specification using static rules, which, for example, enable pattern recognition. If the system specification contains, for example, the keyword SSH including a version number, one analysis result might be the selection of a honeypot that implements the specific SSH version and configures it to include the system-specific SSH banners (e.g., SSH-2.0-OpenSSH_7.4 QNX_Secure_Shell). • Forming Boolean expressions from the target system specification: These can be derived from a written specification in a way that makes them easier for an algorithm (especially a machine learning model) to interpret. A Boolean expression contains variables. Depending on their assignment (true or false), the expression as a whole is evaluated as true or false. A honeypot whose features evaluate the entire expression to true can then be selected. An expression for a honeypot with the SSH and MQTT services and a Linux OS or a configurable OS interface could look like this: (Service_SSH AND Service_MQTT) AND (OS_Linux OR OS_Configurable). A requirement for the honeypot can thus be formulated as a Boolean expression. • Further heuristic or deterministic methods can be selected to support the machine learning model, to select and configure a suitable honeypot.

[0040] This extension of the machine learning model (MAL) can be achieved by analyzing the system specification of the target system using one or more of the methods mentioned above (static rules, Boolean expressions, etc.) and using the result of this analysis as additional input to the machine learning model. This additional input can be weighted relative to the remaining input, so that the machine learning model follows this additional input more or less strictly.

[0041] In various embodiments, the machine learning model is specifically trained for the approach described above, also with a view to meeting safety requirements. The machine learning model can be supervised training using training examples, each containing a training input (i.e., the training system specification and possibly other information, depending on what the machine learning model processes) and a target output (with at least one honeypot configuration matching the training system specification). Such training examples can also be partially generated automatically (e.g., through slight variations in the system specification and corresponding changes in the honeypot configuration).

[0042] In summary, a method is provided according to various embodiments, as described in Fig. 3 shown.

[0043] Fig. Figure 3 shows a flowchart 300, which represents a method for creating a honeypot for a target system according to one embodiment.

[0044] In 301, a machine learning model is trained to output a honeypot configuration appropriate to the input (i.e., for a textually specified target system that is to be imitated by a honeypot) in response to an input (i.e., an input on which the machine learning model is trained) that contains a textual target system specification.

[0045] In port 302, a textual specification of the target system is received.

[0046] In 303, the received textual specification is fed to the trained machine learning model.

[0047] In 304, a honeypot is created according to the configuration that the machine learning model outputs in response to the input of the received textual specification.

[0048] The procedure of Fig.3. This can be performed by one or more computers with one or more data processing units. The term "data processing unit" can be understood as any type of entity that enables the processing of data or signals. The data or signals can, for example, be processed according to at least one (i.e., one or more than one) special function performed by the data processing unit. A data processing unit can include or be composed of an analog circuit, a digital circuit, a logic circuit, a microprocessor, a microcontroller, a central processing unit (CPU), a graphics processing unit (GPU), a digital signal processor (DSP), an integrated circuit, a programmable gate array (FPGA), or any combination thereof.Any other method for implementing the respective functions described in more detail herein may also be understood as a data processing unit or logic circuit arrangement. One or more of the process steps described in detail herein may be executed (e.g., implemented) by a data processing unit through one or more special functions performed by the data processing unit.

[0049] According to various explanations, the process is therefore implemented primarily using computers.

Claims

[1] A method for creating a honeypot (106, 203) for a target system, comprising: Training (301) a machine learning model (204) to output, in response to an input containing a textual target system specification, a honeypot configuration matching the input; Receiving (302) a textual specification of the target system; Feeding (303) the received textual specification to the trained machine learning model (204); and Creating (304) a honeypot (106, 203) according to the configuration, which the machine learning model (204) outputs in response to the input of the received textual specification. [2] The method of claim 1, comprising, prior to supplying the received textual specification to the trained machine learning model, removing data to be kept secret according to a secrecy criterion from the textual specification. [3] The method of claim 1 or 2, wherein the input on which the machine learning model (204) is trained and the received textual specification each comprise an indication of services and / or protocols to be supported by the respective honeypot (106, 203) and / or one or more operating systems to be supported. [4] Method according to one of claims 1 to 3, comprising evaluating the generated honeypot (106, 203) and updating the machine learning model (204) according to the evaluation. [5] Method according to one of claims 1 to 4, wherein the input on which the machine learning model (204) is trained contains information in the form of a result of a static rule and wherein the static rule is applied to the received textual specification, and the received textual specification is fed to the machine learning model (204) together with the result of the application. [6] Method according to one of claims 1 to 5, wherein the input on which the machine learning model (204) is trained contains at least one Boolean expression of target system functionalities and / or target system properties, and wherein at least one Boolean expression is determined from the received textual specification and is supplied to the machine learning model (204) with the received textual specification. [7] The method according to any one of claims 1 to 6, wherein the machine learning model (204) is a large language model. [8] Data processing system with a honeypot generating device, which is arranged to carry out the method according to one of claims 1 to 7. [9] A computer program comprising instructions which, when executed by a processor, cause the processor to perform a method according to any one of claims 1 to 7. [10] A computer-readable medium storing instructions which, when executed by a processor, cause the processor to perform a method according to any one of claims 1 to 7.

Images