CN107872467A - Honeypot active defense method and honeypot active defense system based on Serverless architecture - Google Patents

Abstract

The invention discloses a kind of honey jar active defense method and honey jar Active Defending System Against based on Serverless frameworks, the wherein honey jar active defense method includes：Attack behavior type is identified according to the attack information of attacker, and corresponding dispatch command is generated according to qualification result；The container mirror image of attack processing function corresponding with attack type is selected from mirror image warehouse according to dispatch command and is instantiated, to be created that the container that can run attack processing function, and attack information is handled using container, generates echo message；Echo message is received, and sends it to attacker.Technical scheme enough quickly tackles different types of attack；In addition, " honey jar " is realized using container, have and be preferably environmentally isolated effect, can prevent attacker from passing through the whole place network environment of honey jar environmental threat to the full extent.

Description

Honeypot active defense method and honeypot active defense based on Serverless architecture system

technical field

The invention relates to the field of network technology, in particular to a serverless architecture-based honeypot active defense method and a honeypot active defense system.

Background technique

With the development of the Internet, network security has received extensive attention. The current network security technology is mainly divided into passive defense technology and active defense technology.

Among them, the passive defense technology prevents hackers from externally and controls access internally. It mainly configures security policies through firewalls and other devices, and strives to formulate defense policies before attacks occur, thereby blocking them.

Active defense technologies mainly include technologies such as intrusion detection and honeypots, and strive to sense attacks when they occur, so as to deploy defenses. Among them, the honeypot technology deploys one or more vulnerable hosts in the production network to attract the attention of the attacker and capture the specific attack behavior of the attacker, so as to carry out corresponding defense deployment against these attack behaviors and further protect the The security of the network is strengthened.

However, the existing honeypot systems are all deployed in real system environments and networks with limited resources. For the current increasing number of resource-exhausting denial of service (Denial Of Service, DOS) attacks, it is impossible to Quick response. In addition, the existing honeypot system can cope with a single type of attack and is extremely easy to be compromised; at the same time, since the honeypot system is deployed in a real system environment, once it is discovered and compromised by an attacker, it can be used as a springboard to The entire network environment in which the threat resides.

Contents of the invention

The present invention aims to solve at least one of the technical problems existing in the prior art, and proposes a honeypot active defense method and a honeypot active defense system based on a Serverless architecture.

In order to achieve the above object, the present invention provides a honeypot active defense method based on Serverless architecture, comprising:

Identify the type of attack behavior based on the attacker's attack information, and generate corresponding scheduling instructions based on the identification result;

Select and instantiate the container image of the attack processing function corresponding to the attack behavior type from the mirror warehouse according to the scheduling instruction, so as to create a container capable of running the attack processing function, and use the container to analyze the attack information Process and generate response information;

The response message is received and sent to the attacker.

Optionally, also include:

Record the attack information of the attacker.

Optionally, after the container processes the attack information, it further includes:

Recycle the container.

Optionally, the attack behavior type includes: at least one of port detection attack, SQL injection attack, overflow attack, denial of service attack, encryption attack, password detection attack, flood attack, and unknown type attack.

Optionally, the attack processing function includes: port detection processing function, database request processing function, overflow attack processing function, denial of service attack processing function, encryption attack processing function, password detection processing function, flood attack processing function, unknown attack processing function, At least one of the processing functions;

Wherein, the port detection processing function corresponds to the port detection attack;

The database request processing function corresponds to the SQL injection attack;

The overflow attack processing function corresponds to the overflow attack;

The denial of service attack processing function corresponds to the denial of service attack;

The encryption attack processing function corresponds to the encryption attack;

The encryption attack processing function corresponds to the encryption attack;

The password detection processing function corresponds to the password detection attack;

The flood attack processing function corresponds to the flood attack;

The unknown attack processing function corresponds to the unknown type of attack.

To achieve the above object, the present invention also provides a honeypot active defense system based on Serverless architecture, including:

The attack identification routing module is used to identify the type of attack behavior according to the attack information of the attacker, and generate corresponding scheduling instructions according to the identification result;

The container cluster management module is used to select and instantiate the container image of the attack processing function corresponding to the attack behavior type from the mirror warehouse according to the scheduling instruction, so as to create a container capable of running the attack processing function, and use the The container processes the attack information to generate response information;

The response result processing module is configured to receive the response information and send it to the attacker.

Optionally, it also includes: a log collection module, configured to record the attacker's attack information.

Optionally, the container cluster management module is further configured to recycle the container after the container processes the attack information.

Optionally, the attack behavior type includes: at least one of port detection attack, SQL injection attack, overflow attack, denial of service attack, encryption attack, password detection attack, flood attack, and unknown type attack.

Optionally, the attack processing function includes: port detection processing function, database request processing function, overflow attack processing function, denial of service attack processing function, encryption attack processing function, password detection processing function, flood attack processing function, unknown attack processing function, At least one of the processing functions;

Wherein, the port detection processing function corresponds to the port detection attack;

The database request processing function corresponds to the SQL injection attack;

The overflow attack processing function corresponds to the overflow attack;

The denial of service attack processing function corresponds to the denial of service attack;

The encryption attack processing function corresponds to the encryption attack;

The encryption attack processing function corresponds to the encryption attack;

The password detection processing function corresponds to the password detection attack;

The flood attack processing function corresponds to the flood attack;

The unknown attack processing function corresponds to the unknown type of attack.

The present invention has the following beneficial effects:

The present invention provides a honeypot active defense method and a honeypot active defense system based on a Serverless architecture, wherein the honeypot active defense method includes: identifying the attack behavior type according to the attacker's attack information, and generating a corresponding response according to the identification result. According to the dispatching instruction, the container image of the attack processing function corresponding to the attack behavior type is selected from the mirror warehouse according to the scheduling instruction and instantiated to create a container that can run the attack processing function, and use the container to process the attack information and generate Response message; receive the response message and send it to the attacker. The technical solution of the present invention is capable of quickly responding to different types of attacks; in addition, the "honeypot" is implemented by a container, which has a better environment isolation effect and can prevent attackers from threatening the entire network environment through the honeypot environment to the greatest extent.

Description of drawings

FIG. 1 is a schematic structural diagram of a honeypot active defense system based on a Serverless architecture provided by Embodiment 1 of the present invention;

FIG. 2 is a flow chart of an active defense method for honeypots based on the Serverless architecture provided by Embodiment 2 of the present invention.

Detailed ways

In order for those skilled in the art to better understand the technical solution of the present invention, a serverless architecture-based honeypot active defense method and honeypot active defense system provided by the present invention will be described in detail below in conjunction with the accompanying drawings.

Serverless architecture, also known as serverless architecture, is one of the latest architectural patterns. Its practical significance is: the ability to deploy software without any infrastructure intervention. The serverless platform automates the establishment, deployment, and on-demand startup of services in the entire process. Users only need to register various required business functions and their resource requirements.

The difference from the traditional architecture is that the server-side logic runs in a stateless computing container, which is triggered by events and completely managed by a third party, and its business-level state is recorded by the database and storage resources used by developers. The specific characteristics of the serverless architecture are as follows:

1) Fast startup: It needs to respond quickly to event requests and be able to complete startup at the sub-second level.

2) Elastic expansion: According to application requirements, resources can be automatically allocated on the cluster, and scaled on demand without manual intervention.

3) Good isolation: different applications do not interfere with each other.

4) Robustness: After the execution of the application logic fails, it can be quickly scheduled and re-executed.

Based on the above characteristics of the Serverless architecture, the present invention provides a honeypot active defense method and a honeypot active defense system with better defense functions.

Figure 1 is a schematic structural diagram of a serverless architecture-based honeypot active defense system provided by Embodiment 1 of the present invention. As shown in Figure 1, the system includes: an attack identification routing module 1, a container cluster management module 2 and response result processing Module 3.

Wherein, the attack identification routing module 1 is used to identify the attack behavior type according to the attacker's attack information, and generate corresponding dispatching instructions according to the identification result.

The container cluster management module 2 is used to select and instantiate the container image of the attack processing function corresponding to the attack behavior type from the mirror warehouse according to the scheduling instruction, so as to create a container capable of running the attack processing function, and use the container to process the attack information. Process and generate a response message.

The response result processing module 3 is used to receive the response information and send it to the attacker, so as to confuse the attacker.

In the present invention, the types of attack behaviors that can be identified by the attack identification routing module 1 can be set according to actual experience. As an optional solution, the attack behavior type includes: at least one of port detection attack, SQL injection attack, overflow attack, denial of service (Denial of Service, DOS) attack, encryption attack, password detection attack, and flood attack . In order to improve the completeness of the system, an additional "unknown type of attack" can be set to classify the attack behaviors that do not belong to the above-mentioned known type of attacks into the category of "unknown type of attack".

In practical applications, the more types of attack behaviors that the attack identification routing module 1 can identify, the stronger the defense capability of the honeypot active defense system. In this embodiment, taking the attack behavior types including the above-mentioned port detection attack, SQL injection attack, overflow attack, denial of service attack, encryption attack, password detection attack, flood attack, and unknown type attack as an example, an example description is given . Certainly, the manner of classifying the attack behavior types may also be adjusted according to actual needs.

A mirror warehouse is set in the container cluster management module 2, and attack processing functions for different types of attack behaviors are pre-stored in the mirror warehouse. The "attack processing function" corresponding to the type of attack behavior in the present invention specifically refers to responding to the attacker's attack behavior by simulating a virtual operating system and network service, and feeding back corresponding data to the attacker to create a real operation The illusion that the system and network services are attacked, so as to deceive the attacker. The essence of the attack processing function is the algorithm used to perform corresponding operations on the attacker's attack information.

Optionally in this embodiment, the attack processing function includes: a port detection processing function, a database request processing function, an overflow attack processing function, a denial of service attack processing function, an encryption attack processing function, a password detection processing function, a flood attack processing function, At least one of the unknown attack processing functions; wherein, the port detection processing function corresponds to the port detection attack; the database request processing function corresponds to the SQL injection attack; the overflow attack processing function corresponds to the overflow attack; the denial of service attack processing function corresponds to the denial of service attack Correspondence; encryption attack processing function corresponds to encryption attack; encryption attack processing function corresponds to encryption attack; password detection processing function corresponds to password detection attack; flood attack processing function corresponds to flood attack; unknown attack processing function corresponds to unknown type attack .

Among them, the port detection processing function refers to the algorithm used to calculate the attack information when the simulated operating system or network service is attacked by the port detection; the database request processing function refers to the algorithm used when the simulated operating system or network service is attacked by the database request Algorithm used for computing attack information; overflow attack processing function refers to the algorithm used for computing attack information when simulating an operating system or network service is under overflow attack; denial of service attack processing function refers to The algorithm used to calculate the attack information when the network service is under a denial of service attack; the encrypted attack processing function refers to the algorithm used to calculate the attack information when the simulated operating system or network service is subjected to an encrypted attack; the password detection processing function Refers to the algorithm used to calculate the attack information when the simulated operating system or network service is under a password detection attack; the flood attack processing function refers to the algorithm used to calculate the attack information when the simulated operating system or network service is subjected to a flood attack the algorithm used. The specific algorithms corresponding to each of the above seven processing functions may be selected from algorithms known in the prior art for processing corresponding types of attack behaviors, and examples are not given here.

The unknown attack processing function refers to the algorithm used to calculate the attack information when the simulated operating system or network service is attacked by an unknown type, and it can be set according to actual needs.

The technical solution of the present invention will be described in detail below in combination with examples. Among them, it is assumed that the attacker has carried out a denial of service attack on the system.

First, the attack identification routing module 1 identifies the attack information sent by the attacker according to the pre-stored attack information templates of different attack behavior types, and determines that the attack behavior type is a denial of service attack; then, the attack identification routing module 1 Send a scheduling instruction for scheduling the denial-of-service attack processing function to the container cluster management module 2; then, the container cluster management module 2 dispatches the container image of the denial-of-service attack processing function from the mirror warehouse according to the received scheduling instruction, and uploads it to the cloud service Randomly select an idle node (idle server) in the cluster to instantiate the container image of the denial-of-service attack processing function to create a container capable of running the denial-of-service attack processing function; then, use the container to send process the attack information, generate response information (simulate the output data information after the system is subjected to a denial of service attack), and send the generated response information to the response result processing module 3; finally, the response result processing module 3 sends the response information to the attacker, so as to create the illusion that the real operating system/network service is attacked, so as to deceive the attacker.

It should be noted that container technology has a very good environmental isolation effect on applications, which can prevent attackers from threatening the entire network environment through the honeypot environment to the greatest extent.

Further preferably, the honeypot active defense system provided by the present invention can also realize the dynamic on-demand scaling of system resources; specifically, when the system is attacked suddenly, the system can quickly expand its own computing resources (create containers) to To achieve the purpose of luring the attacker; after the container completes the calculation of the attack information, the container cluster management module 2 will recycle the container resources.

Preferably, the honeypot active defense system further includes: a log collection module 4, and the log collection module 4 is used to record the attacker's attack information. In this embodiment, the container cluster management module 2 is connected to the log collection module 4, and the log collection module 4 can record the attacker's attack behavior for subsequent analysis. In addition, the log collection module 4 can also have the ability to decode encrypted attack protocols, so as to provide support for subsequent security reinforcement.

Embodiment 1 of the present invention provides a honeypot active defense system based on a serverless architecture, which can quickly respond to different types of attacks; in addition, the "honeypot" is implemented by a container, which has a better environmental isolation effect and can maximize To a certain extent, it prevents attackers from threatening the entire network environment through the honeypot environment.

Fig. 2 is a flow chart of a honeypot active defense method based on the Serverless architecture provided by Embodiment 2 of the present invention. As shown in Fig. 2, the honeypot active defense method is based on the honeypot active defense system in the first embodiment above, For the specific description of the honeypot active defense system, please refer to the content in the above-mentioned embodiment one, which will not be repeated here; the honeypot active defense method includes:

Step S1, identifying the attack behavior type according to the attacker's attack information, and generating a corresponding dispatching instruction according to the identification result.

Step S1 is executed by the attack identification routing module in the first embodiment above.

Optionally, the attack behavior type includes: at least one of port detection attack, SQL injection attack, overflow attack, denial of service attack, denial of service attack, encryption attack, password detection attack, flood attack, and unknown type attack. In the present invention, the more types of attack behaviors that the attack identification routing module can identify, the stronger the defense capability of the honeypot active defense system.

Step S2: Select and instantiate the container image of the attack processing function corresponding to the attack behavior type from the mirror warehouse according to the scheduling instruction, so as to create a container capable of running the attack processing function, and use the container to process the attack information and generate a response information.

Step S2 is performed by the container cluster management module in the first embodiment above.

Optionally, the attack processing function includes: port detection processing function, database request processing function, overflow attack processing function, denial of service attack processing function, encryption attack processing function, password detection processing function, flood attack processing function, unknown attack processing function at least one of the Among them, the port detection processing function corresponds to the port detection attack; the database request processing function corresponds to the SQL injection attack; the overflow attack processing function corresponds to the overflow attack; the denial of service attack processing function corresponds to the denial of service attack; the encryption attack processing function corresponds to the encryption attack ; The encryption attack processing function corresponds to the encryption attack; the password detection processing function corresponds to the password detection attack; the flood attack processing function corresponds to the flood attack; the unknown attack processing function corresponds to the unknown type attack.

In this implementation, preferably, after the container completes the processing of the attack information, the container cluster management module reclaims the container resources, so as to realize the dynamic on-demand scaling function of the system.

Step S3, receiving the response information and sending it to the attacker.

Step S3 is executed by the response result processing module in the first embodiment above.

The response result processing module receives the response information generated by the container cluster management module and sends it to the attacker, so as to confuse the attacker.

In this embodiment, preferably, after step S2, it also includes:

Step S4, recording the attacker's attack information.

Step S3 is performed by the log collection module in the first embodiment above.

The log collection module can record the attacker's attack behavior to provide subsequent analysis. In addition, the log collection module can also have the ability to decode encrypted attack protocols, so as to provide support for subsequent security hardening.

It should be noted that the technical solution of the present invention does not limit the execution order of step S4.

For the specific description of the above step S1 to step S4, reference may be made to the corresponding content in the first embodiment above, and details are not repeated here.

Embodiment 2 of the present invention provides a honeypot active defense method based on a Serverless architecture, which can quickly respond to different types of attacks; in addition, the "honeypot" is implemented by a container, which has a better environmental isolation effect and can maximize To a certain extent, it prevents attackers from threatening the entire network environment through the honeypot environment.

It can be understood that, the above embodiments are only exemplary embodiments adopted for illustrating the principle of the present invention, but the present invention is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and essence of the present invention, and these modifications and improvements are also regarded as the protection scope of the present invention.

Claims (10)

1. A honeypot active defense method based on Serverless architecture, characterized in that it comprises: Identify the type of attack behavior based on the attacker's attack information, and generate corresponding scheduling instructions based on the identification result; Select and instantiate the container image of the attack processing function corresponding to the attack behavior type from the mirror warehouse according to the scheduling instruction, so as to create a container capable of running the attack processing function, and use the container to analyze the attack information Process and generate response information; The response message is received and sent to the attacker. 2. honeypot active defense method according to claim 1, is characterized in that, also comprises: Record the attack information of the attacker. 3. honeypot active defense method according to claim 1, is characterized in that, described container also comprises after the step of processing described attack information: Recycle the container. 4. The honeypot active defense method according to claim 1, wherein the attack behavior types include: port detection attack, SQL injection attack, overflow attack, denial of service attack, encryption attack, password detection attack, flooding At least one of attack, unknown type of attack. 5. honeypot active defense method according to claim 4, is characterized in that, described attack processing function comprises: port detection processing function, database request processing function, overflow attack processing function, denial of service attack processing function, encryption attack processing function, password detection processing function, flood attack processing function, and unknown attack processing function; Wherein, the port detection processing function corresponds to the port detection attack; The database request processing function corresponds to the SQL injection attack; The overflow attack processing function corresponds to the overflow attack; The denial of service attack processing function corresponds to the denial of service attack; The encryption attack processing function corresponds to the encryption attack; The encryption attack processing function corresponds to the encryption attack; The password detection processing function corresponds to the password detection attack; The flood attack processing function corresponds to the flood attack; The unknown attack processing function corresponds to the unknown type of attack. 6. A honeypot active defense system based on Serverless architecture, characterized in that it comprises: The attack identification routing module is used to identify the type of attack behavior according to the attack information of the attacker, and generate corresponding scheduling instructions according to the identification result; The container cluster management module is used to select and instantiate the container image of the attack processing function corresponding to the attack behavior type from the mirror warehouse according to the scheduling instruction, so as to create a container capable of running the attack processing function, and use the The container processes the attack information to generate response information; The response result processing module is configured to receive the response information and send it to the attacker. 7. The honeypot active defense system according to claim 6, further comprising: a log collection module configured to record the attacker's attack information. 8. The honeypot active defense system according to claim 6, wherein the container cluster management module is further configured to recycle the container after the container processes the attack information. 9. The honeypot active defense system according to claim 6, wherein the attack behavior types include: port detection attack, SQL injection attack, overflow attack, denial of service attack, encryption attack, password detection attack, flooding At least one of attack, unknown type of attack. 10. The honeypot active defense system according to claim 9, wherein the attack processing function comprises: port detection processing function, database request processing function, overflow attack processing function, denial of service attack processing function, encryption attack processing function function, password detection processing function, flood attack processing function, and unknown attack processing function; Wherein, the port detection processing function corresponds to the port detection attack; The database request processing function corresponds to the SQL injection attack; The overflow attack processing function corresponds to the overflow attack; The denial of service attack processing function corresponds to the denial of service attack; The encryption attack processing function corresponds to the encryption attack; The encryption attack processing function corresponds to the encryption attack; The password detection processing function corresponds to the password detection attack; The flood attack processing function corresponds to the flood attack; The unknown attack processing function corresponds to the unknown type of attack.