Honeypot system, traffic handling method, device, storage medium and program product

Abstract

Provided in the embodiments of the present disclosure are a honeypot system, a traffic handling method, a device, a storage medium and a program product. In an embodiment of the present disclosure, an IP address and a port of a service node that provides a normal application service in a VPC network are used for providing a target service so as to simulate an attacked object, such that there is no need to separately deploy a honeypot node in each VPC network, and there is no need to allocate a separate IP address and a separate port to the honeypot node, thereby reducing resource consumption of a cross-VPC network honeypot system, such as IP addresses, ports and other network resources. The target service for deceiving attackers is deployed on the same service node as the application service rather than being separately deployed on another service node, thereby also reducing computing resource consumption of the honeypot service. Moreover, by means of the client capability and the traffic forwarding capability of a host security service, attack traffic is redirected to the honeypot service system, thereby breaking through the isolation limitation of the VPC network and achieving honeypot traffic redirection in cross-VPC network scenarios.

Description

Honeypot systems, flow processing methods, equipment, storage media and software products

[0001] This disclosure claims priority to Chinese Patent Application No. 202411554842.1, filed with the China Patent Office on November 1, 2024, entitled “Honeypot System, Traffic Processing Method, Device, Storage Medium and Program Product”, the entire contents of which are incorporated herein by reference. Technical Field

[0002] This disclosure relates to the field of cloud security technology, and in particular to a honeypot system, traffic processing method, device, storage medium and program product. Background Technology

[0003] A honeypot is an attack deception system that uses a honeypot to simulate one or more vulnerable hosts and services, providing attackers with an easy target that is disguised as a user's application, making the attacker mistakenly believe that it is the target they want to attack.

[0004] Honeypots are a common intelligence gathering system widely used in the security field. Deploying honeypots is costly, requiring not only a host to run the service but also a significant amount of Internet Protocol (IP) addresses and common ports to disguise themselves as legitimate online hosts.

[0005] In a cloud computing environment, a dedicated private network can be created through a Virtual Private Cloud (VPC) network to achieve resource isolation and control. However, due to the isolation nature of VPC networks, deploying honeypot systems across VPC networks consumes significant resources. Summary of the Invention

[0006] This disclosure provides a honeypot system, traffic processing method, device, storage medium, and program product for reducing resource consumption of honeypot systems across VPC networks.

[0007] In a first aspect, embodiments of this disclosure provide a honeypot system, comprising: multiple virtual private networks; each virtual private network deploying at least one service node; the service node having a target port enabled for providing a target service to simulate an attacked object; the target service being different from the application service provided by the service node;

[0008] The honeypot system also includes a host security service node and a honeypot service system; the network where the host security service node and the honeypot service system are located is different from the multiple virtual private networks.

[0009] The service node is equipped with a host security proxy component; the host security proxy component is used to monitor the target port, and when an access request is detected on the target port, it forwards the access request to the host security service node.

[0010] The host security service node is used to forward the access request to the honeypot service system;

[0011] The honeypot service system is used to process the access request.

[0012] Secondly, this disclosure also provides a traffic processing method applicable to a host security proxy component deployed on a service node in a virtual private network; the service node has a target port enabled; the target port provides a target service to simulate an attacked object; the target service is different from the application service provided by the service node; the method includes:

[0013] Monitor the target port;

[0014] If an access request is detected at the target port, the access request is forwarded to the host security service node, which then forwards the access request to the honeypot service system for processing.

[0015] The host security service node and the honeypot service system are located on networks different from the virtual private network.

[0016] Thirdly, this disclosure also provides a traffic processing method applicable to host security service nodes, the method comprising:

[0017] The system receives access requests forwarded by a host security proxy component; the host security proxy component is deployed on a service node in a virtual private network; the host security proxy component detects the access request from a target port of the service node; the target port provides a target service to simulate an attacked object; the target service is different from the application service provided by the service node.

[0018] The access request is forwarded to the honeypot service system for processing; wherein the network where the host security service node and the honeypot service system are located is different from the virtual private network.

[0019] Fourthly, this disclosure also provides a traffic processing method applicable to honeypot nodes, the method comprising:

[0020] The system receives an access request sent by a host security service node; the access request is sent by a host security proxy component on the service node in the virtual private network; the host security proxy component detects the access request from the target port of the service node; the target port provides a target service to simulate the attacked object; the target service is different from the application service provided by the service node.

[0021] If it is determined that the access request poses an attack risk, the access request is sent to the honeypot management node so that the honeypot management node can determine the risk information associated with the access request and output it.

[0022] The honeypot node, the honeypot management node, and the host security service node are located in networks different from the virtual private network.

[0023] Fifthly, this disclosure also provides a traffic processing method applicable to honeypot management nodes, the method comprising:

[0024] The system receives access requests sent by honeypot nodes; these access requests are sent by the host security proxy component on the service node in the virtual private network to the host security service node, and then forwarded by the host security service node to the honeypot node; the host security proxy component detects the access requests from the target port of the service node; the target port provides a target service to simulate the attacked object; the target service is different from the application service provided by the service node.

[0025] The risk information of the access request is determined and output; wherein the networks where the honeypot node, the honeypot management node and the host security service node are located are different from the virtual private network.

[0026] In a sixth aspect, embodiments of this disclosure also provide an electronic device, including: a memory and a processor; wherein the memory is used to store a computer program;

[0027] The processor is coupled to the memory for executing the computer program to perform steps in the traffic processing methods provided in the second, third, fourth, and / or fifth aspects.

[0028] In a seventh aspect, embodiments of this disclosure also provide a computer-readable storage medium storing computer instructions that, when executed by one or more processors, cause the one or more processors to perform steps in the traffic processing methods provided in the second, third, fourth, and / or fifth aspects.

[0029] Eighthly, embodiments of this disclosure also provide a computer program product, including a computer program that, when executed by one or more processors, causes the one or more processors to perform the steps in the traffic processing methods provided in the second, third, fourth, and / or fifth aspects.

[0030] In this embodiment, the IP addresses and ports of service nodes providing normal application services within the VPC network are used to provide the target service, simulating the attacked object. This eliminates the need to deploy honeypot nodes separately in each VPC network, thus reducing the resource consumption of the honeypot system across VPC networks, such as network resources like IP addresses and ports. Since the target service used to lure attackers resides on the same service node as the application service, instead of being deployed separately, the computational resource consumption of the honeypot service is further reduced. Furthermore, by leveraging the client-side capabilities and traffic forwarding capabilities of the host security service, attack traffic is diverted to the honeypot service system, overcoming the isolation limitations of the VPC network and enabling honeypot traffic redirection across VPC network scenarios. Attached Figure Description

[0031] The accompanying drawings, which are included to provide a further understanding of this disclosure and form part of this disclosure, illustrate exemplary embodiments of the present disclosure and are used to explain the disclosure, but do not constitute an undue limitation of the disclosure. In the drawings:

[0032] Figure 1 is a schematic diagram of the architecture of a honeypot system in a traditional VPC network;

[0033] Figures 2 and 3 are schematic diagrams of the architecture of the honeypot system provided in the embodiments of this disclosure;

[0034] Figures 4, 5, 6 and 7 are schematic flowcharts of the traffic processing method provided in the embodiments of this disclosure;

[0035] Figure 8 is a schematic diagram of the structure of the electronic device provided in the embodiment of this disclosure. Detailed Implementation

[0036] To make the objectives, technical solutions, and advantages of this disclosure clearer, the technical solutions of this disclosure will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this disclosure, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this disclosure without creative effort are within the scope of protection of this disclosure.

[0037] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation portals are provided for users to choose to authorize or refuse.

[0038] The isolation inherent in Virtual Private Cloud (VPC) networks means that a single honeypot system cannot serve multiple VPC networks, requiring separate honeypot nodes to be deployed in each VPC network.

[0039] Specifically, as shown in Figure 1, at least one honeypot node is deployed in each VPC network. Each honeypot node occupies a separate service device, namely a cloud host. The honeypot node is the core component of the honeypot system, primarily used to mimic real systems or services to attract and capture attackers. Honeypot nodes are typically designed with low credibility to mislead attackers into believing they are easily compromised targets. Honeypot nodes can be used for: (1) enticing attackers by mimicking real systems and services to lure them into attacks, thereby consuming their resources and time; (2) collecting intelligence by recording attacker behavior, including the tools, methods, and targets used, providing valuable intelligence for security researchers; and (3) providing real-time alerts by immediately reporting to superiors upon detecting an attack, enabling timely countermeasures.

[0040] The honeypot management node is responsible for managing and coordinating the workflow of the entire honeypot system. It can be used for: (1) installing and configuring honeypot nodes, setting deception strategies and rules; (2) monitoring and analysis, collecting and analyzing data obtained from each honeypot node, and assessing the severity and potential impact of attacks; (3) response and recovery: developing and implementing corresponding emergency response and recovery plans based on the collected information; (4) reporting and auditing: generating detailed reports for the security team and other relevant personnel to refer to, and conducting regular audits to ensure the effectiveness and security of the honeypot system.

[0041] In Figure 1, the user area refers to the area where the service nodes for deploying user application services are located; the control area refers to the area where the control devices for managing and controlling the service nodes are located.

[0042] In the honeypot system shown in Figure 1, an attacker can launch an attack on the honeypot node. Specifically, the attacker can send an access request to the honeypot node through their terminal device to attack the honeypot node (corresponding to step 1, "Attack," in Figure 1). The information carried in the access request is determined by the purpose and type of the attack. Generally, the access request may carry authentication information, command and control information, malicious payload, and / or reconnaissance information, but is not limited to these. Authentication information is used to attempt to log in to the system or service and decrypt certain data or authentication mechanisms. Command and control information may include the command and control server address. Command information is used to remotely control the infected device, such as downloading malware or performing specific tasks. The control server address points to the server controlled by the attacker to receive further instructions. Malicious payload may be malware (such as viruses, Trojans, ransomware, etc.) or embedded scripts used to perform various operations. Reconnaissance information may include network scan data and / or system fingerprints. Network scan data may include port scan interfaces and / or vulnerability scan results. System fingerprints include operating system version, service information, etc., used for subsequent attack planning.

[0043] Honeypot nodes can perform risk detection on access requests and report access requests that are identified as having an attack risk to the honeypot management node (corresponding to step 2 "Reporting Risk" in Figure 1). The honeypot management node then manages the access requests, thereby handling the attack traffic.

[0044] However, the honeypot system shown in Figure 1 requires the deployment of at least one honeypot node in each VPC network. This honeypot node consumes separate network resources within that VPC network, such as Internet Protocol (IP) addresses and ports. Furthermore, since the honeypot node is deployed on a separate service device within the VPC network, it also consumes the VPC network's computing resources. Therefore, the honeypot system shown in Figure 1 has high resource consumption.

[0045] To address the high resource consumption of honeypot systems across VPC networks, some embodiments of this disclosure utilize the IP addresses and ports of service nodes providing normal application services within the VPC network to provide target services and simulate attacked objects. This eliminates the need to deploy honeypot nodes separately in each VPC network, thus reducing the resource consumption of cross-VPC honeypot systems, such as network resources like IP addresses and ports. Furthermore, since the target service used to lure attackers resides on the same service node as the application service, instead of being deployed separately, the computational resource consumption of the honeypot service is also reduced. On the other hand, by leveraging the client capabilities and traffic forwarding capabilities of the host security service, attack traffic is diverted to the honeypot service system, overcoming the isolation limitations of the VPC network and enabling honeypot traffic redirection in cross-VPC network scenarios.

[0046] The technical solutions provided by the embodiments of this disclosure are described in detail below with reference to the accompanying drawings.

[0047] It should be noted that the same reference numerals denote the same object in the following figures and embodiments. Therefore, once an object is defined in one figure or embodiment, it does not need to be discussed further in subsequent figures and embodiments.

[0048] Figure 2 is a schematic diagram of the architecture of the honeypot system provided in this embodiment of the disclosure. As shown in Figure 2, the honeypot system includes multiple Virtual Private Cloud (VPC) networks. Multiple means two or more (including two). Figure 2 only illustrates two VPC networks (i.e., VPC-1 and VPC-2), but this is not intended to be limiting. Each VPC network is deployed with at least one service node 10.

[0049] Service node 10 deploys the application services required by the user, such as database services, security services, cloud communication services, cloud storage services, or cloud computing services, but is not limited to these. Service node 10 can be a single server device, a cloud-based server array, or a virtual machine (VM) running in a cloud-based server array. Alternatively, service node 10 can also refer to other computing devices with corresponding service capabilities, such as computer terminals (running service programs).

[0050] In this embodiment, service node 10 uses host security services to ensure host security. Host security provides system protection and hardening for the host, including security capabilities such as vulnerability detection and remediation, brute-force attacks, file detection, and malicious behavior detection, thus constructing a server security protection system. Host security services refer to a series of solutions and technologies designed to protect computer systems (i.e., hosts) from various security threats.

[0051] Host security services typically consist of two key components: a host security agent component (Agent) 20 and a host security service node (Server) 30. The host security agent component 20 is a software component installed on the client computer, responsible for monitoring and protecting the security status of the host. The host security agent component has the following functions: (1) Continuously monitoring system activity, including process startup, file access, and network connections, and detecting abnormal behavior; (2) Malware protection, using signature libraries and other technologies to identify and block the intrusion of malware such as viruses, Trojans, and worms; (3) Vulnerability assessment: Regularly checking for security vulnerabilities in the system and applications, and reporting issues that need to be fixed; (4) Firewall management: Controlling inbound and outbound traffic to prevent unauthorized access; (5) System hardening: Configuring system settings according to best practices to reduce the risk of attack; (6) Incident response: Responding quickly and taking action when a security incident is detected, such as isolating infected processes or files; (7) Log collection and analysis: Recording system activity logs and sending this data to the host security service node 30 for further analysis, etc.

[0052] The host security service node 30 is a centralized management platform, typically located in the cloud or on-premises data center, used to process data from multiple host security agent components 20 and provide a unified security policy management interface. The main functions of the host security service node 30 include: (1) Policy management: defining and implementing security policies, such as antivirus rules, firewall rules, etc., and pushing them to each host security agent component 20; (2) Log aggregation and analysis: collecting log data from all host security agent components 20, performing centralized analysis, and helping to identify potential security threats; (3) Alarms and notifications: generating alarms and notifying administrators via email, SMS, etc. when a security event is detected; (4) Reporting and compliance: generating detailed reports to help organizations meet compliance requirements and providing audit trails; (5) Automated response: automatically performing certain operations according to preset rules, such as isolating infected hosts, updating signature databases, etc.; (6) Central management interface: providing an intuitive user interface that allows administrators to easily view the security status of the entire network and make necessary adjustments.

[0053] In this embodiment, the host security proxy component 20 is deployed on a service node in a VPC network. The network where the host security service node 30 is located is different from the aforementioned VPCs. The host security service node 30 is generally deployed in the cloud, i.e., in the internal network of a cloud service provider, and exposes the public IP address of the host security service to the outside world for users to use and access the host security service.

[0054] Since service node 10 uses a host security service to ensure host security, this service has client-side and traffic forwarding capabilities. The client-side function refers to deploying a host security proxy component 20 on the user's service node 10 as a client for the host security service. The traffic forwarding function means that the host security proxy component 20 can forward monitored traffic to the host security service node 30; the host security service node 30 can also forward traffic outwards. Based on this, the client-side function of the host security service can be used to capture attack traffic and achieve honeypot traffic redirection; and the traffic forwarding function of the host security service can be used to forward the captured attack traffic to the honeypot service system 40 for processing.

[0055] Based on this, in this embodiment, a target port can be started on service node 10. This target port serves as a honeypot port, providing target services to simulate the attacked object. To avoid port conflicts and reduce the impact of the honeypot service on the normal application services provided by the service node, the target port and the port providing the normal application services are different ports, and the target service provided by the target port is different from the normal application services provided by the service node. When an attacker launches an attack on the target service, they can send attack traffic to the target port of service node 10, that is, send access requests to the target port of service node 10 (corresponding to step 1 "Access Request" in Figures 2 and 3).

[0056] The host security proxy component 20 can monitor the target port (corresponding to step 2 "Port Monitoring" in Figures 2 and 3), and when an access request is detected on the target port, it forwards the access request to the host security service node 30 (corresponding to step 3 "Access Request Forwarding" in Figures 2 and 3). In this embodiment, the access request can also be forwarded to the honeypot service system 40 by means of the forwarding function of the host security service node 30. The honeypot service system 40 is located in a network different from the aforementioned multiple VPC networks; it resides within the intranet of the cloud service provider offering the honeypot service.

[0057] The honeypot service system 40 and the host security service node 30 can be located on the same intranet or on different intranets. Preferably, the honeypot service system 40 and the host security service node 30 are on the same intranet. Because when they are on the same intranet, the honeypot service system 40 can use the public IP address of the host security service without exposing its own public IP address. This way, since the honeypot service does not expose its own public IP address, attackers cannot use it to launch attacks, reducing the probability of attacks and improving its security. Furthermore, by using the public IP address of the host security service, users can access the honeypot service using the host security service's IP address, thus meeting their needs.

[0058] In this embodiment, the host security service node 30 can forward the access request to the honeypot service system 40 (corresponding to step 4 "Access Request Forwarding" in Figures 2 and 3). Specifically, as shown in Figures 2 and 3, the host security service node 30 can use its traffic forwarding module to forward the access request to the honeypot service system 40, diverting attack traffic to the honeypot service system 40. The honeypot service system 40 can then process the access request.

[0059] In this embodiment, the IP addresses and ports of service nodes providing normal application services within the VPC network are used to provide the target service, simulating the attacked object. This eliminates the need to deploy honeypot nodes separately in each VPC network, thus reducing the resource consumption of the honeypot system across VPC networks, such as network resources like IP addresses and ports. Since the target service used to lure attackers resides on the same service node as the application service, instead of being deployed separately, the computational resource consumption of the honeypot service is further reduced. Furthermore, by leveraging the client-side capabilities and traffic forwarding capabilities of the host security service, attack traffic is diverted to the honeypot service system, overcoming the isolation limitations of the VPC network and enabling honeypot traffic redirection across VPC network scenarios.

[0060] Furthermore, in the honeypot system architecture shown in Figure 1, the honeypot nodes are deployed on independent cloud hosts with different IP addresses from the application service cloud hosts. This results in a small deception exposure surface, and there is a possibility that the application service system may be attacked while the honeypot remains unaffected. In this embodiment, the IP address and port of the service node (i.e., the cloud host) where the application service resides are used. Since the target service and application service are on the same service node as the deception target, the deception exposure surface is increased, reducing the possibility that the application service system may be attacked while the honeypot remains unaffected.

[0061] To reduce the cost of modifying the honeypot service system architecture, the traditional honeypot service system architecture can be reused, specifically the architecture of honeypot nodes and honeypot management nodes. As shown in Figure 3, in this embodiment, the honeypot service system 40 may include honeypot node 40a and honeypot management node 40b. Honeypot node 40a and honeypot management node 40b are located in the same internal network, but are different from the aforementioned multiple VPC networks. For a description of the roles and functions of the honeypot node and honeypot management node 40b, please refer to the relevant content in the foregoing embodiments; they will not be repeated here.

[0062] In this embodiment, honeypot node 40a can expose its port to host security service node 30. Host security service node 30 can then forward access traffic to the port of honeypot node 40a (corresponding to step 4 "Access Request Forwarding" in Figure 3), thus forwarding the access traffic to honeypot service system 40. Honeypot node 40a can also send access requests to honeypot management node 40b if there is an attack risk (corresponding to step 5 "Report Risk" in Figure 3).

[0063] In some embodiments, since the target port is used to capture or spoof attack traffic, normal traffic generally does not access this target port. Therefore, access requests detected by the host security proxy component 20 on the target port can be directly considered as attack traffic. Thus, the honeypot node 40a can directly identify access requests forwarded by the host security service node 30 as access requests with attack risks.

[0064] In other embodiments, risk detection rules can be pre-configured in honeypot node 40a. If honeypot node 40a determines that an access request matches a risk detection rule, it determines that the access request poses an attack risk. In this disclosure, the specific implementation of the risk detection rules is not limited. In some embodiments, allowed lists can be pre-configured in honeypot node 40a. These allowed lists may include IP addresses whose requests are considered safe traffic. Based on this, honeypot node 40a can perform risk detection on access requests according to the pre-defined allowed lists; if the source IP address of the access request does not exist in the allowed lists, it determines that the access request poses an attack risk. Using allowed lists for risk detection can reduce the false positive rate. Allowed lists ensure that legitimate requests are not interfered with.

[0065] In other embodiments, clue data is collected in advance. This clue data includes attribute information of requests identified as having an attack risk. Clue data may include, but is not limited to, one or more of the following: user feedback or complaint data, interception data from a risk control system, and network security intelligence data. "Multiple" refers to two or more types. The request attribute information may include the identifier of the user to whom the request belongs and the network quaternion of the request. The network quaternion includes: source IP address and source port, and destination IP address and destination port. Accordingly, risk detection can be performed on access requests based on the pre-collected clue data; if the attribute information of the access request matches the attribute information of requests identified as having an attack risk contained in the aforementioned clue data, then the access request is determined to have an attack risk. Wherein, the matching of the access request attribute information with the attribute information of requests identified as having an attack risk contained in the aforementioned clue data can be implemented as follows: the user identifier of the access request is the same as the user identifier of the request identified as having an attack risk, and / or, all or part of the network quaternion of the access request is the same as the network quaternion of the request identified as having an attack risk. Specifically, the matching of a portion of the network four-tuple of an access request with that of a request identified as having an attack risk can be achieved by either: the source IP address and source port of the access request being the same as those of the request identified as having an attack risk, or vice versa. Utilizing historical data for risk detection can reduce the false positive rate. Historical data provides a more accurate basis for risk assessment, preventing legitimate access requests from being mistakenly identified as attack requests.

[0066] The method by which honeypot node 40a performs risk detection on access requests as illustrated in the foregoing embodiments is merely illustrative and does not constitute a limitation. Furthermore, if honeypot node 40a determines that an access request poses an attack risk, it forwards the access request to honeypot management node 40b. Honeypot management node 40b can then determine the risk information of the access request.

[0067] In this embodiment, the specific content of the risk information determined by the honeypot management node 40b is not limited. In some embodiments, the honeypot management node 40b can obtain the attribute information of the target service node in the access request attack. The attribute information of the target service node refers to the basic information of the target service node, which may include one or more of the following: the service node's identity identifier (i.e., a unique identifier used to distinguish different hosts), IP address, the hostname corresponding to the service node (the name of the host in the network), the VPC network to which the service node belongs, and the user to which the service node belongs. "Multiple" refers to two or more (including two).

[0068] The host security service node 30 manages the attribute information of service nodes. As shown in Figure 3, the asset management module in the host security service node 30 is used to manage the attribute information of service nodes. To enable the honeypot control node 40b to accurately identify the attribute information of the target service node attacked by the access request from the host security service node 30, in some embodiments of this disclosure, the host security proxy component 20 carries its identifier in the access request when forwarding it to the host security service node. The identifier of the host security proxy component 20 refers to information that uniquely identifies a host security proxy component 20, and can be a Universally Unique Identifier (UUID) for the host security proxy component 20. UUID is a technology used to generate unique identifiers, designed to ensure that identifiers generated in a distributed network environment are unique.

[0069] Furthermore, the host security proxy component 20 can forward access requests carrying the identifier of the host security proxy component to the host security service node 30. The host security service node 30 then forwards the access requests carrying the identifier of the host security proxy component to the port of the honeypot node 40a. If the access request poses an attack risk, the honeypot node 40a will send the access request carrying the identifier of the host security proxy component to the honeypot management node 40b.

[0070] Since each service node 10 deploys a host security proxy component 20, and each host security proxy component 20 has a unique identifier, the identifier of the host security proxy component 20 corresponds one-to-one with the service node. Based on this, the honeypot management node 40b can obtain the attribute information of the target service node attacked by the access request from the host security service node 30 according to the identifier of the host security proxy component 20 (corresponding to step 6 "Asset Integration" in Figure 3). Furthermore, the risk information of the access request can be determined based on the attribute information of the target service node and / or the access request.

[0071] In some embodiments, the honeypot management node 40b can record attack events on access requests to obtain risk information about the access requests. This risk information may include: the recorded attack time, source IP address, attack method, and number of attacks within a certain time period.

[0072] Honeypot management node 40b can also determine the severity and potential impact of an attack based on the attack method of the access request; and determine the risk level based on the severity and potential impact of the attack, and use the risk level as risk information.

[0073] The honeypot management node 40b can also determine the asset information of the access request attack based on the attribute information of the target service node, as the risk information of the access request. This asset information may include the IP address, hostname, and user ID of the target service node.

[0074] The implementation method and specific content of the honeypot control node 40b in determining the risk information of access requests shown in the foregoing embodiments are merely illustrative and do not constitute a limitation.

[0075] After identifying the risk information of the access request, the honeypot management node 40b can output the risk information, thereby informing the user of the attack risk. Optionally, the honeypot management node 40b can send the risk information of the access request to the user to whom the target service node belongs. For example, the honeypot management node 40b can send the risk information of the access request to the terminal device of the user to whom the target service node belongs via telephone, SMS, email, and / or instant messaging, so that the user to whom the target service node belongs can be aware of the potential attack risk in a timely manner and take timely defense measures.

[0076] In addition to providing a honeypot system, this disclosure also provides a corresponding traffic processing method. The traffic processing method provided in this disclosure is illustrated below from the perspectives of a host security proxy component deployed in a service node, a host security service node, a honeypot node, and a honeypot management node.

[0077] Figures 4 and 5 are schematic flowcharts of the traffic processing method provided in the embodiments of this disclosure. The traffic processing method provided in Figure 4 is mainly applicable to host security proxy components deployed on service nodes in a VPC network. The traffic processing method provided in Figure 5 is mainly applicable to host security service nodes. In these methods, the service node starts with a target port; the target port provides a target service to simulate an attacked object; the target service is different from the application service provided by the service node.

[0078] As shown in Figure 4, the traffic processing methods performed by the host security proxy component mainly include:

[0079] 401. Monitor the target port.

[0080] 402. If an access request is detected on the target port, the access request is forwarded to the host security service node, which then forwards the access request to the honeypot service system for processing.

[0081] As shown in Figure 5, the traffic processing methods performed by the host security service node mainly include:

[0082] 501. Receive access requests forwarded by the host security proxy component.

[0083] 502. Forward the access request to the honeypot service system for processing.

[0084] In this embodiment, the service node starts a target port, which serves as a honeypot port, providing a target service to simulate an attacked object. To avoid port conflicts and reduce the impact of the honeypot service on the normal application services provided by the service node, the target port and the port providing the normal application services are different ports, and the target service provided by the target port is different from the normal application services provided by the service node. When an attacker launches an attack on the target service, they can send attack traffic to the target port of the service node, that is, send access requests to the target port of the service node.

[0085] Based on this, in step 401, the host security proxy component can monitor the target port, and if an access request is detected on the target port, in step 402, it forwards the access request to the host security service node. In this embodiment of the disclosure, the access request can also be forwarded to the honeypot service system by means of the forwarding function of the host security service node. The honeypot service system is located in a network different from the aforementioned VPC network; it resides within the intranet of the cloud service provider offering the honeypot service.

[0086] The honeypot service system and the host security service node can be located on the same intranet or on different intranets. Preferably, the honeypot service system and the host security service node are on the same intranet. Because when they are on the same intranet, the honeypot service system can use the public IP address of the host security service without exposing its own public IP address. This prevents attackers from using the honeypot service's public IP address to launch attacks, reducing the probability of attacks and improving the honeypot service's security. Furthermore, by using the host security service's public IP address, users can also use the host security service's IP address to access the honeypot service, fulfilling their needs.

[0087] In this embodiment of the disclosure, as shown in step 501 of FIG5, the host security service node can receive the access request forwarded by the host security proxy component; and in step 502, the access request is forwarded to the honeypot service system, diverting the attack traffic to the honeypot service system. The honeypot service system can process the access request.

[0088] In this embodiment, the IP addresses and ports of service nodes providing normal application services within the VPC network are used to provide the target service, simulating the attacked object. This eliminates the need to deploy honeypot nodes separately in each VPC network, thus reducing the resource consumption of the honeypot system across VPC networks, such as network resources like IP addresses and ports. Since the target service used to lure attackers resides on the same service node as the application service, instead of being deployed separately, the computational resource consumption of the honeypot service is further reduced. Furthermore, by leveraging the client-side capabilities and traffic forwarding capabilities of the host security service, attack traffic is diverted to the honeypot service system, overcoming the isolation limitations of the VPC network and enabling honeypot traffic redirection across VPC network scenarios.

[0089] Furthermore, in the honeypot system architecture shown in Figure 1, the honeypot nodes are deployed on independent cloud hosts with different IP addresses from the application service cloud hosts. This results in a small deception exposure surface, and there is a possibility that the application service system may be attacked while the honeypot remains unaffected. In this embodiment, the IP address and port of the service node (i.e., the cloud host) where the application service resides are used. Since the target service and application service are on the same service node as the deception target, the deception exposure surface is increased, reducing the possibility that the application service system may be attacked while the honeypot remains unaffected.

[0090] To reduce the cost of modifying the honeypot service system architecture, the traditional honeypot service system architecture can be reused, specifically the architecture of the honeypot nodes and honeypot management nodes. The honeypot nodes and honeypot management nodes 40b are located in the same internal network, but in a different network than the aforementioned VPC network.

[0091] In this embodiment, the honeypot node can expose its port to the host security service node. In this way, the host security service node can forward access traffic to the port of the honeypot node, thereby forwarding access traffic to the honeypot service system.

[0092] Accordingly, the traffic processing method performed on the honeypot node mainly includes the following steps shown in Figure 6:

[0093] 601. Receive access requests sent by the host security service node.

[0094] 602. If an access request is determined to pose an attack risk, the access request is sent to the honeypot management node so that the honeypot management node can determine the risk information associated with the access request and output it.

[0095] For honeypot nodes, if there is an attack risk in the access request, the access request can be sent to the honeypot management node.

[0096] In some embodiments, since the target port is used to capture or spoof attack traffic, normal traffic generally does not access this target port. Therefore, access requests detected by the host security proxy component on the target port can be directly considered as attack traffic. Thus, access requests forwarded by the host security service node can be directly identified as access requests with attack risks.

[0097] In other embodiments, risk detection rules can be pre-configured in the honeypot node. If an access request matches a risk detection rule, the access request is determined to pose an attack risk. In this disclosure, the specific implementation of the risk detection rules is not limited. In some embodiments, allowed lists can be pre-configured in the honeypot node. These allowed lists may include IP addresses whose requests are considered safe traffic. Based on this, access requests can be risk-detected according to the pre-defined allowed lists; if the source IP address of the access request does not exist in the allowed lists, the access request is determined to pose an attack risk.

[0098] In other embodiments, clue data is collected in advance. Based on the pre-collected clue data, access requests can be subjected to risk detection; if the attribute information of the access request matches the attribute information of requests identified as having an attack risk in the aforementioned clue data, then the access request is determined to have an attack risk.

[0099] The method for honeypot nodes to detect risks in access requests, as illustrated in the foregoing embodiments, is merely illustrative and does not constitute a limitation. Furthermore, if a honeypot node determines that an access request poses an attack risk, it forwards the request to a honeypot management node for traffic processing. Figure 7 is a schematic diagram of the traffic processing flow performed by the honeypot management node. As shown in Figure 7, the main steps include:

[0100] 701. Receive access requests sent by honeypot nodes.

[0101] 702. Determine the risk information of the access request.

[0102] 703. Output risk information.

[0103] The honeypot management node can determine the risk information of the access request. In this embodiment, the specific content of the risk information determined by the honeypot management node is not limited. In some embodiments, the honeypot management node can obtain attribute information of the target service node attacked by the access request.

[0104] The host security service node management system contains attribute information about the service nodes. To enable the honeypot control node to accurately identify the attribute information of the target service node attacked by the access request from the host security service node, in some embodiments of this disclosure, the host security proxy component carries its identifier in the access request when forwarding it to the host security service node.

[0105] Furthermore, the host security proxy component can forward access requests carrying its identifier to the host security service node. The host security service node then forwards the access requests carrying the host security proxy component's identifier to the honeypot node's port. If the access request poses an attack risk, the honeypot node will send the access request carrying the host security proxy component's identifier to the honeypot management node.

[0106] Since each service node deploys a host security proxy component, and each host security proxy component has a unique identifier, there is a one-to-one correspondence between the identifier of the host security proxy component and the service node. Based on this, the honeypot management node can obtain the attribute information of the target service node attacked by the access request from the host security service node according to the identifier of the host security proxy component. Furthermore, the risk information of the access request can be determined based on the attribute information of the target service node and / or the access request. For specific implementation methods for determining the risk information of the access request, please refer to the relevant content of the foregoing embodiments, which will not be repeated here.

[0107] After identifying the risk information of the access request, the risk information of the access request can be output, thereby informing the user of the attack risk of the access request, so that the user of the target service node can be aware of the potential attack risk in a timely manner and take timely defense measures.

[0108] It should be noted that the execution subject of each step of the method provided in the above embodiments can be the same device, or the method can be executed by different devices. For example, the execution subject of steps 401 and 402 can be device A; or the execution subject of step 401 can be device A, and the execution subject of step 402 can be device B; and so on.

[0109] Furthermore, some processes described in the above embodiments and accompanying drawings include multiple operations that appear in a specific order. However, it should be clearly understood that these operations may not be executed in the order they appear herein, or they may be executed in parallel. The operation numbers, such as 401, 402, etc., are merely used to distinguish different operations and do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed sequentially or in parallel.

[0110] Accordingly, this disclosure also provides a computer-readable storage medium storing computer instructions, which, when executed by one or more processors, cause the one or more processors to perform the steps in the traffic processing methods provided in the foregoing embodiments.

[0111] This disclosure also provides a computer program product, including a computer program that, when executed by one or more processors, causes the one or more processors to perform the steps in the traffic processing methods provided in the foregoing embodiments. In this disclosure, the specific implementation of the computer program product is not limited. In some embodiments, the computer program product may be implemented as an application (APP), a mini-program, a PC-side client, a program module, a plug-in, an installation package, a software development kit (SDK), an optical disc image file (such as an ISO file), a plug-in, or software in the form of Software as a Service (SaaS), etc., but is not limited thereto.

[0112] Figure 8 is a schematic diagram of the structure of an electronic device provided in an embodiment of this disclosure. As shown in Figure 8, the electronic device includes a memory 80a and a processor 80b. The memory 80a is used to store computer programs.

[0113] The processor 80b is coupled to the memory 80a and is used to execute a computer program to perform the steps in the traffic processing methods provided in the foregoing embodiments. Specific implementation details of each step can be found in the relevant descriptions of the foregoing embodiments, and will not be repeated here.

[0114] In some alternative embodiments, as shown in FIG8, the electronic device may further include optional components such as a communication component 80c, a power supply component 80d, a display component 80e, and an audio component 80f. FIG8 only schematically shows some components and does not mean that the electronic device must include all the components shown in FIG8, nor does it mean that the electronic device can only include the components shown in FIG8.

[0115] Furthermore, the components within the dashed boxes in Figure 8 are optional, not mandatory, and their specific requirements depend on the product form of the electronic device. The electronic device in this embodiment can be a desktop computer, laptop computer, mobile phone, or IoT device; it can also be a traditional server, cloud server, or server cluster, or other server equipment.

[0116] In embodiments of this disclosure, the memory is used to store computer programs and can be configured to store various other data to support operation on its host device. The processor can execute the computer programs stored in the memory to implement corresponding control logic. The memory can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random-Access Memory (SRAM), Electrically Erasable Programmable Read Only Memory (EEPROM), Electrically Programmable Read Only Memory (EPROM), Programmable Read Only Memory (PROM), Read Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0117] In this embodiment of the disclosure, the processor can be any hardware processing device capable of executing the above-described method logic. Optionally, the processor can be a central processing unit (CPU), a graphics processing unit (GPU), or a microcontroller unit (MCU); it can also be a programmable device such as a field-programmable gate array (FPGA), a programmable array logic (PAL), a general array logic (GAL), or a complex programmable logic device (CPLD); or it can be an advanced RISC machine (ARM) or a system on chip (SoC), etc., but is not limited thereto.

[0118] In embodiments of this disclosure, the communication component is configured to facilitate wired or wireless communication between its host device and other devices. The device housing the communication component can access wireless networks based on communication standards, such as Wireless Fidelity (WiFi), 2G or 3G, 4G, 5G, or combinations thereof. In one exemplary embodiment, the communication component receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In another exemplary embodiment, the communication component may also be implemented based on Near Field Communication (NFC), Radio Frequency Identification (RFID), Infrared Data Association (IrDA), Ultra Wide Band (UWB), Bluetooth (BT), or other technologies.

[0119] In embodiments of this disclosure, the display component may include a liquid crystal display (LCD) and a touch panel (TP). If the display component includes a touch panel, the display component may be implemented as a touchscreen to receive input signals from a user. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensors may sense not only the boundaries of touch or swipe actions but also the duration and pressure associated with the touch or swipe operation.

[0120] In embodiments of this disclosure, a power supply component is configured to provide power to various components of the device in which it resides. The power supply component may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the device in which the power supply component resides.

[0121] In embodiments of this disclosure, the audio component can be configured to output and / or input audio signals. For example, the audio component includes a microphone (MIC) configured to receive external audio signals when the device containing the audio component is in an operating mode, such as call mode, recording mode, or voice recognition mode. The received audio signals can be further stored in memory or transmitted via a communication component. In some embodiments, the audio component also includes a speaker for outputting audio signals. For example, in devices with voice interaction capabilities, voice interaction with a user can be achieved through the audio component.

[0122] It should be noted that the terms "first" and "second" in this article are used to distinguish different messages, devices, modules, etc., and do not represent a chronological order, nor do they limit "first" and "second" to different types.

[0123] Those skilled in the art will understand that embodiments of this disclosure can be provided as methods, systems, or computer program products. Therefore, this disclosure can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this disclosure can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, compact disc read-only memory (CD-ROM), optical storage, etc.) containing computer-usable program code.

[0124] This disclosure is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in one or more flowchart illustrations and / or one or more block diagrams.

[0125] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means that implement the functions specified in one or more flowcharts and / or one or more block diagrams.

[0126] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, such that the instructions, which execute on the computer or other programmable apparatus, provide steps for implementing the functions specified in one or more flowcharts and / or one or more block diagrams.

[0127] In a typical configuration, a computing device includes one or more processors (CPU, etc.), input / output interfaces, network interfaces, and memory.

[0128] Memory may include non-persistent storage in computer-readable media, such as random-access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0129] Computer storage media are readable storage media, also known as removable media. Removable and non-removable media can be used to store information by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, Digital Video Disc (DVD) or other optical storage, magnetic tape, disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient media, such as modulated data signals and carrier waves.

[0130] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes the aforementioned element.

[0131] The above description is merely an embodiment of this disclosure and is not intended to limit the scope of this disclosure. Various modifications and variations can be made to this disclosure by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this disclosure should be included within the scope of the claims of this disclosure.

Claims

1. A honeypot system, wherein, include: Multiple Virtual Private Networks; Each virtual private network has at least one service node deployed; The service node is started with a target port to provide target services in order to simulate the attacked object; the target service is different from the application services provided by the service node. The honeypot system also includes a host security service node and a honeypot service system; the network where the host security service node and the honeypot service system are located is different from the multiple virtual private networks. The service node is equipped with a host security proxy component. The host security proxy component is used to monitor the target port, and when an access request is detected on the target port, it forwards the access request to the host security service node. The host security service node is used to forward the access request to the honeypot service system; The honeypot service system is used to process the access request.

2. The system according to claim 1, wherein, The honeypot service system includes: honeypot nodes and honeypot management nodes; the honeypot nodes expose ports to the host security service nodes. The host security service node is used to forward the access request to the port of the honeypot node; When processing the access request, the honeypot service system specifically uses the following methods: The honeypot node is used to send the access request to the honeypot management node if the access request is at risk of being attacked. The honeypot management node is used to determine the risk information associated with the access request and output the risk information.

3. The system according to claim 1 or 2, wherein, The host security service node and the honeypot service system are located on the same internal network, and the Internet Protocol address of the host security service node is exposed to the outside world.

4. A traffic processing method applicable to a host security proxy component deployed on a service node in a virtual private network; wherein, The service node is started with a target port; The target port provides the target service to simulate the attacked object; The target service is different from the application service provided by the service node; the method includes: Monitor the target port; If an access request is detected at the target port, the access request is forwarded to the host security service node, which then forwards the access request to the honeypot service system for processing. The host security service node and the honeypot service system are located on networks different from the virtual private network.

5. The method according to claim 4, wherein, Forwarding the access request to the host security service node includes: The identifier of the host security agent component is included in the access request; The access request carrying the identifier of the host security proxy component is forwarded to the host security service node, so that the host security service node can forward the access request carrying the identifier of the host security proxy component to the honeypot service system for processing.

6. A traffic processing method applicable to host security service nodes, wherein, The method includes: The system receives access requests forwarded by a host security proxy component; the host security proxy component is deployed on a service node in a virtual private network; the host security proxy component is used to monitor the access request from a target port of the service node; the target port provides a target service to simulate an attacked object; the target service is different from the application service provided by the service node. The access request is forwarded to the honeypot service system for processing; wherein the network where the host security service node and the honeypot service system are located is different from the virtual private network.

7. A traffic processing method applicable to honeypot nodes, wherein, The method includes: The system receives an access request sent by a host security service node; the access request is sent by a host security proxy component on the service node in the virtual private network; the host security proxy component is used to monitor the access request from the target port of the service node; the target port provides a target service to simulate the attacked object; the target service is different from the application service provided by the service node. If it is determined that the access request poses an attack risk, the access request is sent to the honeypot management node so that the honeypot management node can determine the risk information associated with the access request and output it. The honeypot node, the honeypot management node, and the host security service node are located in networks different from the virtual private network.

8. The method according to claim 7, wherein, The method further includes: The received access request was determined to pose an attack risk; or, Based on a preset permitted list, the access request is subjected to risk detection; if the source Internet Protocol address of the access request does not exist in the permitted list, it is determined that the access request poses an attack risk. or, Based on pre-collected clue data, the access request is subjected to risk detection; the clue data includes attribute information of requests identified as having an attack risk; if the attribute information of the access request matches the attribute information of the request with an attack risk, then the access request is determined to have an attack risk.

9. A traffic processing method applicable to honeypot control nodes, wherein, The method includes: The system receives access requests sent by honeypot nodes; these access requests are sent by a host security proxy component on a service node in the virtual private network to a host security service node, and then forwarded by the host security service node to the honeypot node; the host security proxy component is used to monitor the access requests from the target port of the service node; the target port provides a target service to simulate the attacked object; the target service is different from the application service provided by the service node. The risk information of the access request is determined and output; wherein the networks where the honeypot node, the honeypot management node and the host security service node are located are different from the virtual private network.

10. The method according to claim 9, wherein, The access request carries the identifier of the host security proxy component; determining the risk information of the access request includes: Based on the identifier of the host security proxy component, obtain the attribute information of the service node of the access request attack from the host security service node; The risk information is determined based on the attribute information of the service node attacked by the access request and the access request itself.

11. A traffic processing method, applicable to honeypot control nodes, characterized in that, The method includes: Receive access requests reported by honeypot nodes that pose an attack risk; Based on the source network quadruple and attack payload characteristics of the access request, query the historical attack event database to determine whether it belongs to a known attack pattern. If it belongs to a known attack pattern, the access request will be marked as the corresponding attack family and associated with the historical handling record; If it does not belong to a known attack pattern, a new attack warning is generated, and the attack characteristics are extracted and stored in the clue database. The output includes a risk information report that includes attack pattern classification, associated risk level, and handling recommendations.

12. A traffic processing method, applicable to a honeypot service system, characterized in that, The method includes: It receives attack traffic from multiple VPC networks, which is forwarded to the honeypot node through the host security proxy component and the host security service node; Based on the source IP address, target service type, and attack behavior characteristics of the attack traffic, an attacker behavior graph is constructed. Cluster analysis of behavioral graphs can be performed to identify whether multiple attack sessions belong to the same attack group. If the attacks are identified as coming from the same attacking group, an attack chain view across the VPC network is generated and output to the management platform.

13. A traffic processing method, applicable to host security service nodes, characterized in that, The method includes: Receive honeypot policy configuration instructions issued by users through the management platform. The policy includes the target port, simulated service type, and decoy content. The honeypot policy is distributed to the host security proxy components on one or more service nodes in the specified VPC network; The host security agent component starts the target port and loads the decoy service configuration on the corresponding service node to achieve dynamic honeypot deployment.

14. A traffic processing method, applicable to honeypot control nodes, characterized in that, The method includes: After determining that the access request involves high-risk attack behavior, a defense recommendation instruction is generated; The defense recommendation instruction is sent from the host security service node to the host security proxy component corresponding to the attacked service node; The defense recommendation instruction is used to trigger the host security agent component to perform local defense actions, including: Block access from the source IP address, close high-risk ports, enable process behavior monitoring, or isolate suspicious files.

15. A traffic processing method, applicable to a honeypot service system, characterized in that, The method includes: Receive access requests from the host security service node; Determine the threat level based on the target port and service characteristics of the access request; If the request is for a low-threat detection type, it will be routed to a lightweight honeypot instance for response; If the request is a high-threat attack, it will be routed to a highly realistic honeypot instance for in-depth interaction. Implement multi-level honeypot traffic distribution based on risk level.

16. A traffic processing method, applicable to honeypot control nodes, characterized in that, The method includes: Receive honeypot data query requests initiated by user terminals, wherein the requests carry the target service node identifier or time range; Based on the request, retrieve attack event records for the corresponding time period from the log database; The attack event record includes: attack time, source IP, attack method, interaction content, risk level, and handling status; The search results are returned to the user's terminal in the form of visual charts.

17. A traffic processing method, applicable to a host security proxy component, characterized in that, The method includes: After receiving an access request on the target port of the service node, record the complete network session log of the request; The network session log and access request are forwarded together to the host security service node; The network session log includes: TCP handshake process, application layer protocol interaction content, payload data, and session duration; This is used to perform in-depth behavioral analysis and attack reproduction on honeypot service systems.

18. An electronic device, wherein, include: A memory and a processor; wherein the memory is used to store computer programs; The processor is coupled to the memory for executing the computer program to perform the steps of the method according to any one of claims 4-17.

19. A computer-readable storage medium storing computer instructions, wherein, When the computer instructions are executed by one or more processors, the one or more processors are caused to perform the steps of the method according to any one of claims 4-17.

20. A computer program product, wherein, Includes a computer program that, when executed by one or more processors, causes the one or more processors to perform the steps of the method according to any one of claims 4-17.

Images