CN115514514A - Honeypot flow traction device and method, computer equipment and storage medium - Google Patents

Abstract

The invention relates to a honeypot flow traction device, a honeypot flow traction method, computer equipment and a storage medium, and relates to the technical field of Internet, wherein the device comprises a honeypot management platform, honeypot nodes, a honeypot flow traction service end and a honeypot flow traction terminal; the honeypot flow traction server and the honeypot management platform are deployed on the same machine node, and the honeypot flow traction terminal is deployed in an isolation network different from the honeypot management platform; one honeypot flow traction server is deployed, and a plurality of honeypot flow traction terminals are deployed in each isolation network. In a complex isolation network, an encryption tunnel is established between a honeypot flow traction server and a honeypot flow traction terminal through a single port opened by a firewall. And drawing the required flows of different isolation network segments into the honeypot system according to a routing table and a related acquisition strategy which are issued by the honeypot flow drawing server to the honeypot flow drawing terminal.

Description

A honeypot traffic pulling device, method, computer equipment and storage medium

technical field

The present invention relates to the field of computer technology, in particular to a honeypot flow traction device, method, computer equipment and storage medium.

Background technique

Due to the honeypot deployment method and business characteristics, traffic in the network environment needs to be selectively diverted. For example, between different DMZ areas and between high-sensitivity services, some traffic in different isolated networks will not be diverted.

Common drainage technology solutions mainly fall into the following three categories:

The first type is traffic traction with the help of third-party security products. For example, through the ACL of the firewall, each access behavior of the honeypot is set and released one by one. When the attacker launches an attack, according to the existing ACL rules on the firewall, the Traffic is led to the honeypot system through this scheme.

The second type is traffic traction through a reverse proxy, that is, a reverse proxy server is set up between the protection device and the honeypot. When the attacker triggers an attack and reaches the protection device, the Specific traffic is drawn into the honeypot system.

The third type is traffic traction through UDP tunnels. By deploying a collection plug-in in the target virtual machine, when the client is started in the virtual machine, the honeypot will send the port information to be collected to the client and communicate with the client. To establish a UDP tunnel. When the attacker launches an attack, the client will draw the required network card traffic to the honeypot system through UDP according to the received policy information.

However, the first category relies on third-party security products such as firewalls for traffic diversion. This solution requires frequent changes to the configuration of firewalls or other security products, and honeypot products usually do not have the authority to control third-party security products, so this traffic diversion method Ease of use is low in actual use.

The second type is traffic traction through reverse proxy. This method usually cannot respond to arp and tcp requests, and can only pull the traffic data of a specific port, so it cannot be completely covered and configured for honeypot access.

The third category is to pull traffic by establishing a UDP tunnel. This technical solution needs to encapsulate the identification information of the target in the UDP message, and then pull the traffic through the configuration of the identification. After receiving the information, the other party needs to process the data to unpack. This solution requires secondary packaging of the original flow, which increases the volume of the flow, affects traction efficiency, and has poor reliability.

To sum up, it is necessary to design a new traffic traction method to achieve efficient, safe and reliable drainage and solve the above problems.

Contents of the invention

The purpose of the present invention is to provide a honeypot traffic pulling device, method, computer equipment and storage medium to solve the above-mentioned existing technical problems.

To achieve the above object, the present invention provides the following technical solutions:

In the first aspect, an embodiment of the present invention provides a honeypot flow pulling device, including: a honeypot management platform, a honeypot node, a honeypot flow pulling server, and a honeypot flow pulling terminal;

The honeypot flow pulling service end and the honeypot management platform are deployed on the same machine node, and the honeypot flow pulling terminal is deployed in an isolated network different from the honeypot management platform;

One honeypot flow pulling server is deployed, and multiple honeypot flow pulling terminals are deployed in each isolated network.

As a further solution of the present invention, the honeypot traffic pulling service end is in the isolated network A, the honeypot traffic pulling terminal is in the isolated network B, and a firewall is deployed between the isolated network A and the isolated network B, and the firewall is used to control the isolated network A Access authorization with isolated network B.

As a further solution of the present invention, the traction traffic between the honeypot flow traction terminal and the honeypot traffic traction service end is two-way intercommunication, and the honeypot traffic traction server is used to receive the traffic sent by the honeypot traffic traction terminal, and the honeypot traffic flow The traction terminal is used to receive the traffic sent by the honeypot traffic traction server.

As a further solution of the present invention, an encrypted tunnel is set between the honeypot traffic pulling terminal and the honeypot traffic pulling server, and traffic of all protocol types is sent and received through the tunnel.

As a further solution of the present invention, when an attacker's access traffic arrives at the network card of the honeypot traffic pulling terminal, and the destination address of the attacker's access hits a pre-configured rule, the honeypot traffic pulling device is used to The destination address is converted by DNAT, the source address is not rewritten, and the original source IP in the message is retained.

As a further solution of the present invention, when the honeypot flow traction device performs DNAT conversion, it includes the following steps:

Rewrite the destination address to the virtual subnet IP address of the virtual network card on the honeypot traffic pulling terminal machine. At this time, according to the system routing table settings of the machine where the honeypot traffic pulling terminal is located, the traffic leading to the honeypot traffic pulling server passes through this machine The virtual network card is read by the honeypot traffic pulling terminal and sent to the honeypot traffic pulling server through the established tunnel;

The honeypot traffic traction server receives the traffic through the virtual network card. At this time, according to the routing table strategy, the traffic is sent to the corresponding honeypot node. The address that the honeypot node listens to is the IP address of the virtual subnet;

The honeypot node receives the attack traffic to obtain the real attacker IP and responds;

The response of the honeypot node to the specified traffic flows back to the honeypot traffic pulling terminal node through the tunnel between the honeypot traffic pulling server and the honeypot traffic pulling terminal, and the honeypot traffic pulling terminal node returns the response traffic to The originator of the request.

As a further solution of the present invention, the destination address of the attacker's attack is the address of the network card in the machine where the traffic is pulled by the honeypot traffic.

As a further solution of the present invention, when the address monitored by the honeypot node is the IP address of the virtual subnet, the traffic starts from the ebpf from-tun ingress hook, and the <traffic quintuple, virtual device ID> mapping is written into /sys/fs/ Traffic is released after bpf/tc/globals.

As a further solution of the present invention, after the honeypot node receives the attack traffic and obtains the real attacker IP and makes a response, since the attacker IP starts from any IP, the default routing rule is written into the default network card (eth0), and by querying /sys/ After the fs/bpf/tc/globals table obtains the source device of the return traffic, use bpf_perf_event_output to redirect the traffic to the virtual device and write it back to the traffic pulling terminal for SNAT conversion, thereby completing the complete routing link of the traffic.

In a second aspect, the embodiment of the present invention provides a honeypot traffic pulling method, comprising the following steps:

The honeypot flow traction server obtains the IP address of the honeypot node service from the honeypot management platform and records it;

Start the honeypot traffic pulling terminal, create a virtual network card, and establish a connection with the honeypot traffic pulling server through the port that communicates with the isolated network A and isolated network B configured in the firewall;

After the honeypot traffic pulling server receives the first request from the honeypot traffic pulling terminal, it creates a virtual network card locally for tunnel communication with the honeypot traffic pulling terminal;

The IP of the virtual network card and the routing table strategy issued by the honeypot traffic pulling server to the honeypot traffic pulling terminal;

The honeypot traffic pulling terminal sets the IP address of the virtual network card to the IP address sent by the honeypot traffic pulling server, and configures the corresponding routing table strategy;

The honeypot traffic pulling server and the honeypot traffic pulling terminal have established an encrypted tunnel and successfully formed a virtual subnet;

In the isolated network A and the isolated network B, communicate through the encrypted tunnel;

The traffic that accesses the network card of the machine where the honeypot traffic pulling terminal is located will be converted to the destination address through the above-mentioned DNAT conversion method according to the established routing table strategy, and the specified traffic will be pulled to the virtual network card created by the honeypot traffic pulling terminal;

After the honeypot traffic pulling terminal reads the traffic received by the virtual network card, it pulls the traffic to the peer-to-peer virtual network card of the machine where the honeypot traffic pulling server is located through the tunnel;

After the honeypot traffic pulling server receives the traffic through the virtual network card, it will pull the traffic to the designated target honeypot node according to the configuration items;

After the honeypot node receives the traffic, it responds, sends the generated response traffic to the honeypot traffic server, and sends the response traffic to the honeypot traffic terminal through the tunnel; after the honeypot traffic traction terminal receives the traffic, it sends The response traffic is written back to the virtual network card and sent to the traffic initiator after the source address is converted by the SNAT conversion method;

Record the quintuple and the corresponding virtual network card device during server ingress;

When the server is egress, write to the virtual network card device by querying the mapping table in the above.

As a further solution of the present invention, a honeypot management platform is installed on the isolation network A, and a honeypot traffic traction server is installed on the machine where the honeypot management platform is located; the honeypot management platform deploys honeypot node services; Tank flow pull terminal.

In a third aspect, an embodiment of the present invention provides a computer device, including a memory, a processor, and a computer program stored on the memory and operable on the processor. When the processor executes the program, the steps of the above honeypot traffic pulling method are implemented. .

In a fourth aspect, the embodiment of the present invention also provides a computer-readable storage medium, on which a computer program is stored, and when the program is executed by a processor, the steps of the above honeypot traffic pulling method are implemented.

The technical solutions provided by the embodiments of the present invention may include the following beneficial effects:

The honeypot flow pulling device, method, computer equipment and storage medium provided by the present invention, in a complex isolated network, a single port opened by a firewall between the isolated networks enables the honeypot flow pulling server and the honeypot flow pulling terminal to establish encryption tunnel. According to the routing table and related collection strategies issued by the honeypot traffic pulling server to the honeypot traffic pulling terminal, the required traffic of different isolated network segments is pulled to the honeypot system.

These or other aspects of the present application will be more concise and understandable in the description of the following embodiments. It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the application.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings that need to be used in the embodiments or the description of the prior art. Obviously, the accompanying drawings in the following description are only for the application. some examples. In the attached picture:

Fig. 1 is a schematic structural diagram of a honeypot flow pulling device in an exemplary embodiment of the present invention;

FIG. 2 is a hardware architecture diagram of a computer device in an embodiment of the present invention.

The realization of the purpose, functions and advantages of the present application will be further described in conjunction with the embodiments and with reference to the accompanying drawings.

detailed description

Below, the present application will be further described in conjunction with the accompanying drawings and specific implementation methods. It should be noted that, on the premise of not conflicting, the various embodiments described below or the technical features can be combined arbitrarily to form a new embodiment. .

Since the first type uses third-party security products to pull traffic, the second type uses reverse proxy to pull traffic, and the third type uses UDP tunnels to pull traffic, the first type uses third-party security products such as firewalls. Traffic diversion, this solution requires frequent changes to the configuration of firewalls or other security products, and honeypot products usually do not have the authority to control third-party security products, so this diversion method is less easy to use in actual use. The second type is traffic traction through reverse proxy. This method usually cannot respond to arp and tcp requests, and can only pull the traffic data of a specific port, so it cannot be completely covered and configured for honeypot access. The third category is to pull traffic by establishing a UDP tunnel. This technical solution needs to encapsulate the identification information of the target in the UDP message, and then pull the traffic through the configuration of the identification. After receiving the information, the other party needs to process the data to unpack. This solution requires secondary packaging of the original flow, which increases the volume of the flow, affects traction efficiency, and has poor reliability.

Therefore, the honeypot flow traction device, method, computer equipment and storage medium of the present invention realize efficient, safe and reliable drainage.

Referring to FIG. 1 , an embodiment of the present application provides a honeypot traffic pulling device, including a honeypot management platform, a honeypot node, a honeypot traffic pulling server, and a honeypot traffic pulling terminal.

When the honeypot traffic pulling device is deployed, the honeypot traffic pulling server and the honeypot management platform are deployed on the same machine node, and the honeypot traffic pulling terminal is deployed in an isolated network different from the honeypot management platform.

One honeypot flow pulling server is deployed, and multiple honeypot flow pulling terminals are deployed in each isolated network. That is: deploy one honeypot traffic pulling server, and deploy multiple honeypot traffic pulling terminals in each isolated network. The honeypot traffic pulling server and the honeypot management platform are deployed on the same machine node, and the honeypot traffic pulling terminal is deployed in an isolated network different from the honeypot management platform.

In the embodiment of the present invention, the honeypot traffic pulling server is in the isolated network A, and the honeypot traffic pulling terminal is in the isolated network B. A firewall is deployed between isolated network A and isolated network B to control access authorization between isolated networks.

In an embodiment of the present invention, the traffic of the honeypot traffic pulling terminal and the honeypot traffic pulling server is two-way intercommunication, the honeypot traffic pulling server is used to receive the traffic sent by the honeypot traffic pulling terminal, and the honeypot The traffic pulling terminal is used to receive the traffic sent by the honeypot traffic pulling server.

In the embodiment of the present invention, an encrypted tunnel is set between the honeypot traffic pulling terminal and the honeypot traffic pulling server, and traffic of all protocol types is sent and received through the tunnel.

The description of traffic flow is as follows:

When the attacker's access traffic reaches the network card of the honeypot traction terminal, and the destination address of the attacker's access hits the pre-configured rules, the destination address will be DNAT converted, and the source address will not be rewritten (MASQURADE). The original source IP in the message is preserved.

The DNAT conversion process of the attacker's attack traffic is described in detail below:

First of all, the destination address of the attacker's attack is the address of the network card in the machine where the traffic is pulled by the honeypot traffic. In order to realize the traffic pulling of the traffic across the isolated network, the destination address needs to be rewritten, that is, the destination address should be rewritten to the virtual subnet IP address of the virtual network card on the honeypot traffic pulling terminal machine. At this time, according to the system routing table settings of the machine where the honeypot traffic pulling terminal is located, the traffic leading to the honeypot traffic server will pass through the local virtual network card, and then be read by the honeypot traffic pulling terminal and sent to Honeypot traffic pulls the server.

The honeypot traffic traction server receives traffic through the virtual network card. At this time, according to the routing table strategy, the traffic is delivered to the corresponding honeypot node, and the address that the honeypot node listens to is the IP address of the virtual subnet (virtual network card device).

At this time, the traffic starts from the ebpf from-tun ingress hook, writes the mapping of <traffic quintuple, virtual device ID> into /sys/fs/bpf/tc/globals and releases the traffic.

The honeypot node receives the attack traffic and obtains the real attacker IP and responds. Since the attacker IP is any IP, the default routing rule is written into the default network card (eth0), and obtained by querying the /sys/fs/bpf/tc/globals table After returning to the source device of the traffic, use bpf_perf_event_output to redirect the traffic to the virtual device and write it back to the traffic pulling terminal for SNAT conversion, thereby completing the complete routing link of the traffic.

That is, the honeypot traction terminal will access the traffic of the designated honeypot node target, through the tunnel between the honeypot traffic traction server and the honeypot traffic traction terminal, and divert the traffic to the honeypot traction server, and the honeypot traction server will follow the pre-configured The traffic pulling configuration sends the traffic to the final target honeypot node.

At the same time, the response of the honeypot node to the specified traffic also flows back to the honeypot traffic pulling terminal node through the tunnel between the honeypot traffic pulling server and the honeypot traffic pulling terminal, and the honeypot traffic pulling terminal node will respond Traffic is returned to the originator of the request.

In some embodiments of the present application, as shown in FIG. 1 , a honeypot traffic pulling method of this embodiment is shown, and the pulling process of the honeypot traffic pulling method includes the following steps:

Step 1. Install the honeypot management platform on the isolation network A, and install the honeypot flow traction server on the machine where the honeypot management platform is located;

Step 2, the honeypot management platform deploys the honeypot node service;

Step 3, the honeypot flow traction server obtains the IP address of the honeypot node service from the honeypot management platform, and records it;

Step 4. Install a honeypot flow traction terminal on the isolated network B;

Step 5. Next, enter the tunnel establishment process;

Step 6. Start the honeypot flow pulling terminal, create a virtual network card, and establish a connection with the honeypot flow pulling server through the port that communicates with the isolation network A and isolation network B configured in the firewall;

Step 7: After receiving the first request from the honeypot traffic pulling terminal, the honeypot traffic pulling server creates a virtual network card locally for tunnel communication with the honeypot traffic pulling terminal;

Step 8. The honeypot traffic pulling server sends the IP of the virtual network card of the honeypot traffic pulling terminal, as well as the routing table strategy;

Step 9. Set the IP address of the virtual network card on the honeypot traffic pulling terminal to the IP address sent by the honeypot traffic pulling server, and configure the corresponding routing table strategy;

Step 10. At this point, an encrypted tunnel is established between the honeypot traffic pulling server and the honeypot traffic pulling terminal, and a virtual subnet is successfully formed;

Step 11. In the isolation network A and isolation network B, communication can be carried out through this tunnel;

Step 12. Access the traffic of the network card of the machine where the honeypot traffic pulling terminal is located. According to the established routing table strategy, the destination address will be converted through the above DNAT conversion method, and the specified traffic will be pulled to the virtual network card created by the honeypot traffic pulling terminal. ;

Step 13, after the honeypot traffic pulling terminal reads the traffic received by the virtual network card, it pulls the traffic to the peer-to-peer virtual network card of the machine where the honeypot traffic pulling server is located through the tunnel;

Step 14: After the honeypot traffic pulling server receives the traffic through the virtual network card, it will pull the traffic to the designated target honeypot node according to the configuration items;

Step 15: After the honeypot node receives the traffic, it responds, sends the generated response traffic to the honeypot traffic server, and sends the response traffic to the honeypot traffic terminal through the tunnel; the honeypot traffic traction terminal receives After the traffic flow, write the response traffic back to the virtual network card, and after the source address conversion by the above-mentioned SNAT conversion method, send it to the traffic initiator;

Step sixteen, record the quintuple and the corresponding virtual network card device when the server is ingressing;

Step 17. When the server is egressing, query the above mapping table and write it into the virtual network card device to ensure which port the traffic comes from and returns to which port.

It should be understood that the specific embodiments described here are only used to explain the present application, and are not intended to limit the present application.

The following will clearly and completely describe the technical solutions in the embodiments of the present application with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of them. Based on the embodiments in this application, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the scope of protection of this application.

The flow charts shown in the drawings are just illustrations, and do not necessarily include all contents and operations/steps, nor must they be performed in the order described. For example, some operations/steps can be decomposed, combined or partly combined, so the actual order of execution may be changed according to the actual situation.

Some implementations of the present application will be described in detail below in conjunction with the accompanying drawings. In the case of no conflict, the following embodiments and features in the embodiments can be combined with each other.

As shown in FIG. 1, in the embodiment of the present invention, the honeypot traffic pulling device has three network areas: the Internet area, the office network area, and the private network area. They are isolated from each other by firewalls, and the networks are not connected to each other.

In the embodiment of this application, the honeypot management platform, honeypot nodes and honeypot traffic pulling server are deployed in the private network area. In the Internet area and the office network area, a honeypot traffic pulling device was deployed, and a honeypot traffic pulling terminal was installed. The honeypot traffic pulling terminals in the Internet area and the office network area have created virtual network card A and virtual network card B on their respective machines.

The honeypot traffic pulling terminal A in the Internet area passes through the firewall A, the core switch and the firewall B, only through a single port, and establishes a connection with the honeypot traffic pulling server in the private network area through encrypted negotiation through the TCP protocol.

At the same time, the honeypot traffic pulling terminal B deployed in the office network area, through the designated single port opened by firewall B, establishes a connection with the honeypot traffic pulling server in the private network area through encrypted negotiation through the TCP protocol.

After the honeypot traffic pulling server receives the networking request from the honeypot traffic pulling terminal A in the Internet area and the honeypot traffic pulling terminal B in the office network area, it sends the honeypot traffic pulling terminal A in the Internet area and the office network area The honeypot traffic pulling terminal B is assigned a designated virtual subnet IP address, and issued a routing policy that needs to be forwarded to the honeypot node.

In the embodiment of this application, the traffic of accessing a specific honeypot in the Internet area passes through the virtual network card A, and the honeypot traffic is drawn to the terminal A, and is drawn to the honeypot node in the private network area through the subnet tunnel. After the honeypot node processes, parses, and records the specified traffic, it responds to the specific honeypot traffic, passes through the tunnel in reverse, returns to the honeypot traffic in the Internet area to pull terminal A, and finally sends it to the traffic initiator to complete a honeypot request and processing and response.

In the embodiment of this application, the traffic from the office network network area to access a specific honeypot passes through the virtual network card B, and the honeypot traffic is drawn to the terminal B, and is drawn to the honeypot node in the private network area through the subnet tunnel, and the honeypot node controls the specified traffic After processing, parsing, and recording, respond to specific honeypot traffic, pass through the tunnel in reverse, return to the honeypot traffic in the Internet area to pull terminal A, and finally send it to the traffic initiator, completing a honeypot request, processing and response .

This embodiment also provides a computer device. As shown in FIG. 2, the computer device includes a plurality of computer devices 1000. In the embodiment, the components of the honeypot traffic pulling device can be dispersed in different computer devices 1000. The computer device 1000 can be a smart phone, a tablet computer, a laptop computer, a desktop computer, a rack server, a blade server, a tower server, or a rack server (including an independent server, or a server cluster composed of multiple servers) for executing programs. Wait. The computer device 1000 in this embodiment at least includes but is not limited to: a memory 1001 and a processor 1002 that can be communicatively connected to each other through a system bus. It should be understood, however, that implementation of all illustrated components is not a requirement, and that more or fewer components may instead be implemented.

In this embodiment, the memory 1001 (that is, a readable storage medium) includes a flash memory, a hard disk, a multimedia card, a card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), Read Only Memory (ROM), Electrically Erasable Programmable Read Only Memory (EEPROM), Programmable Read Only Memory (PROM), Magnetic Memory, Magnetic Disk, Optical Disk, etc. In some embodiments, the storage 1001 may be an internal storage unit of the computer device 1000 , such as a hard disk or memory of the computer device 1000 . In other embodiments, the memory 1001 can also be an external storage device of the computer device 1000, such as a plug-in hard disk equipped on the computer device 1000, a smart memory card (SmartMediaCard, SMC), a secure digital (SecureDigital, SD) card , Flash card (FlashCard) and so on. Of course, the storage 1001 may also include both the internal storage unit of the computer device 1000 and its external storage device. In this embodiment, the memory 1001 is generally used to store the operating system and various application software installed in the computer equipment, such as the honeypot traffic pulling device in the embodiment. In addition, the memory 1001 can also be used to temporarily store various types of data that have been output or will be output.

The processor 1002 may be a central processing unit (Central Processing Unit, CPU), a controller, a microcontroller, a microprocessor, or other data processing chips in some embodiments. The processor 1002 is generally used to control the overall operation of the computer device 1000 . In this embodiment, the processor 1002 is configured to run program codes stored in the memory 1001 or process data. When the processors 1002 of multiple computer devices 1000 of the computer device in this embodiment jointly execute the computer program, the honeypot traffic pulling method of the embodiment is implemented, including the following steps:

Step 1. Install the honeypot management platform on the isolation network A, and install the honeypot flow traction server on the machine where the honeypot management platform is located;

Step 2, the honeypot management platform deploys the honeypot node service;

Step 3, the honeypot flow traction server obtains the IP address of the honeypot node service from the honeypot management platform, and records it;

Step 4. Install a honeypot flow traction terminal on the isolated network B;

Step 5. Next, enter the tunnel establishment process;

Step 6. Start the honeypot flow pulling terminal, create a virtual network card, and establish a connection with the honeypot flow pulling server through the port that communicates with the isolation network A and isolation network B configured in the firewall;

Step 7: After receiving the first request from the honeypot traffic pulling terminal, the honeypot traffic pulling server creates a virtual network card locally for tunnel communication with the honeypot traffic pulling terminal;

Step 8. The honeypot traffic pulling server sends the IP of the virtual network card of the honeypot traffic pulling terminal, as well as the routing table strategy;

Step 9. Set the IP address of the virtual network card on the honeypot traffic pulling terminal to the IP address sent by the honeypot traffic pulling server, and configure the corresponding routing table strategy;

Step 10. At this point, an encrypted tunnel is established between the honeypot traffic pulling server and the honeypot traffic pulling terminal, and a virtual subnet is successfully formed;

Step 11. In the isolation network A and isolation network B, communication can be carried out through this tunnel;

Step 12. Access the traffic of the network card of the machine where the honeypot traffic pulling terminal is located. According to the established routing table strategy, the destination address will be converted through the above DNAT conversion method, and the specified traffic will be pulled to the virtual network card created by the honeypot traffic pulling terminal. ;

Step 13, after the honeypot traffic pulling terminal reads the traffic received by the virtual network card, it pulls the traffic to the peer-to-peer virtual network card of the machine where the honeypot traffic pulling server is located through the tunnel;

Step 14: After the honeypot traffic pulling server receives the traffic through the virtual network card, it will pull the traffic to the designated target honeypot node according to the configuration items;

Step 15: After the honeypot node receives the traffic, it responds, sends the generated response traffic to the honeypot traffic server, and sends the response traffic to the honeypot traffic terminal through the tunnel; the honeypot traffic traction terminal receives After the traffic flow, write the response traffic back to the virtual network card, and after the source address conversion by the above-mentioned SNAT conversion method, send it to the traffic initiator;

Step sixteen, record the quintuple and the corresponding virtual network card device when the server is ingressing;

Step 17. When the server is egressing, query the above mapping table and write it into the virtual network card device to ensure which port the traffic comes from and returns to which port.

Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a general hardware platform, and of course also by hardware. Those of ordinary skill in the art can understand that all or part of the processes in the methods of the above-mentioned embodiments can be completed by instructing related hardware through a computer program. The program can be stored in a computer-compatible storage medium, and the program can be executed when , may include the flow of the embodiments of the above-mentioned methods.

Embodiments of the present application also provide a computer-readable storage medium, such as flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM) , read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic storage, magnetic disk, optical disk, server, App application store, etc., on which are stored computer Program, the program implements corresponding functions when executed by the processor. The computer-readable storage medium of this embodiment stores the honeypot traffic pulling device 10 of the embodiment, and implements the honeypot traffic pulling method of the embodiment when executed by a processor, including the following steps:

Step 1. Install the honeypot management platform on the isolation network A, and install the honeypot flow traction server on the machine where the honeypot management platform is located;

Step 2, the honeypot management platform deploys the honeypot node service;

Step 3, the honeypot flow traction server obtains the IP address of the honeypot node service from the honeypot management platform, and records it;

Step 4. Install a honeypot flow traction terminal on the isolated network B;

Step 5. Next, enter the tunnel establishment process;

Step 6. Start the honeypot flow pulling terminal, create a virtual network card, and establish a connection with the honeypot flow pulling server through the port that communicates with the isolation network A and isolation network B configured in the firewall;

Step 7: After receiving the first request from the honeypot traffic pulling terminal, the honeypot traffic pulling server creates a virtual network card locally for tunnel communication with the honeypot traffic pulling terminal;

Step 8. The honeypot traffic pulling server sends the IP of the virtual network card of the honeypot traffic pulling terminal, as well as the routing table strategy;

Step 9. Set the IP address of the virtual network card on the honeypot traffic pulling terminal to the IP address sent by the honeypot traffic pulling server, and configure the corresponding routing table strategy;

Step 10. At this point, an encrypted tunnel is established between the honeypot traffic pulling server and the honeypot traffic pulling terminal, and a virtual subnet is successfully formed;

Step 11. In the isolation network A and isolation network B, communication can be carried out through this tunnel;

Step 12. Access the traffic of the network card of the machine where the honeypot traffic pulling terminal is located. According to the established routing table strategy, the destination address will be converted through the above DNAT conversion method, and the specified traffic will be pulled to the virtual network card created by the honeypot traffic pulling terminal. ;

Step 13, after the honeypot traffic pulling terminal reads the traffic received by the virtual network card, it pulls the traffic to the peer-to-peer virtual network card of the machine where the honeypot traffic pulling server is located through the tunnel;

Step 14: After the honeypot traffic pulling server receives the traffic through the virtual network card, it will pull the traffic to the designated target honeypot node according to the configuration items;

Step 15: After the honeypot node receives the traffic, it responds, sends the generated response traffic to the honeypot traffic server, and sends the response traffic to the honeypot traffic terminal through the tunnel; the honeypot traffic traction terminal receives After the traffic flow, write the response traffic back to the virtual network card, and after the source address conversion by the above-mentioned SNAT conversion method, send it to the traffic initiator;

Step sixteen, record the quintuple and the corresponding virtual network card device when the server is ingressing;

Step 17. When the server is egressing, query the above mapping table and write it into the virtual network card device to ensure which port the traffic comes from and returns to which port.

Through the description of the above embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus a necessary general-purpose hardware platform, and of course also by hardware, but in many cases the former is better implementation.

The honeypot flow pulling device, method, computer equipment and storage medium provided by the present invention, in a complex isolated network, a single port opened by a firewall between the isolated networks enables the honeypot flow pulling server and the honeypot flow pulling terminal to establish encryption tunnel. According to the routing table and related collection strategies issued by the honeypot traffic pulling server to the honeypot traffic pulling terminal, the required traffic of different isolated network segments is pulled to the honeypot system.

The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structures or equivalent process transformations made by using the description of the application and the accompanying drawings are directly or indirectly used in other related technical fields. , are all included in the patent protection scope of the present application in the same way.

Claims (10)

1. The utility model provides a honeypot flow draw gear which characterized in that for high-efficient, safe, reliable drainage, include: the system comprises a honeypot management platform, honeypot nodes, a honeypot flow traction server and a honeypot flow traction terminal;

the honeypot flow traction server and the honeypot management platform are deployed on the same machine node, and the honeypot flow traction terminal is deployed in an isolation network different from the honeypot management platform;

one honeypot flow traction server is deployed, and a plurality of honeypot flow traction terminals are deployed in each isolation network.

2. The honeypot flow traction device according to claim 1, wherein the honeypot flow traction server is located on an isolation network A, the honeypot flow traction terminal is located on an isolation network B, and a firewall is deployed between the isolation network A and the isolation network B and used for controlling access authorization between the isolation network A and the isolation network B.

3. The honeypot flow traction device of claim 1, wherein the flow traction of the honeypot flow traction terminal and the honeypot flow traction server are in bidirectional communication, the honeypot flow traction server is configured to receive the flow sent by the honeypot flow traction terminal, and the honeypot flow traction terminal is configured to receive the flow sent by the honeypot flow traction server.

4. The honeypot flow traction device of claim 3, wherein an encrypted tunnel is arranged between the honeypot flow traction terminal and the honeypot flow traction server, and all protocol types of flows are transmitted and received through the tunnel.

5. The honeypot traffic traction device according to claim 4, wherein when the access traffic of an attacker reaches the network card of the honeypot traffic traction terminal, and the destination address accessed by the attacker hits a pre-configured rule, the honeypot traffic traction device is configured to perform DNAT conversion on the destination address without rewriting the source address and retain the original source IP in the message.

6. The honeypot flow traction device of claim 5, wherein the honeypot flow traction device comprises the following steps when performing DNAT conversion:

the destination address is rewritten into a virtual subnet IP address of a virtual network card on a honeypot flow traction terminal machine, at the moment, according to the system routing table setting of the machine where the honeypot flow traction terminal is located, the flow to the honeypot flow traction server passes through the local virtual network card, is read by the honeypot flow traction terminal and then is sent to the honeypot flow traction server through the established tunnel;

the honeypot flow traction server receives the flow through the virtual network card, and then sends the flow to the corresponding honeypot node according to the routing table strategy, wherein the address monitored by the honeypot node is the IP address of the virtual subnet;

the honeypot node receives the attack flow to obtain a real attacker IP and responds;

the response of the honeypot node to the specified flow flows back to the honeypot flow traction terminal node through the tunnel between the honeypot flow traction server and the honeypot flow traction terminal, and the honeypot flow traction terminal node returns the response flow to the request initiator.

7. The honeypot traffic pulling device according to claim 6, wherein the destination address of the attacker attack is an address of a network card of the traffic in a machine where the honeypot traffic pulling terminal is located.

8. The honeypot flow traction method is characterized by comprising the following steps:

the honeypot flow traction server side acquires the IP address of honeypot node service from the honeypot management platform and records the IP address;

starting a honeypot flow traction terminal, creating a virtual network card, and establishing connection with a honeypot flow traction server through a port which is communicated with an isolation network A and an isolation network B which are configured in a firewall;

after receiving a first request of a honeypot flow traction terminal, a honeypot flow traction server creates a virtual network card for tunnel communication with the honeypot flow traction terminal;

the honeypot flow traction server side issues an IP (Internet protocol) of a virtual network card to the honeypot flow traction terminal and a routing table strategy;

the honeypot flow traction terminal sets the IP address of the virtual network card as the IP address sent by the honeypot flow traction server side, and configures a corresponding routing table strategy;

the honeypot flow traction server side and the honeypot flow traction terminal establish an encrypted tunnel, and successfully form a virtual subnet;

in the isolation network A and the isolation network B, communication is carried out through the encryption tunnel;

accessing the flow of a machine network card where a honeypot flow traction terminal is located, performing destination address conversion through a DNAT conversion method according to a formulated routing table strategy, and drawing the specified flow to a virtual network card created by the honeypot flow traction terminal;

after reading the flow received by the virtual network card, the honeypot flow traction terminal draws the flow to the peer-to-peer virtual network card of the machine where the honeypot flow traction server side is located through the tunnel;

after receiving the flow through the virtual network card, the honeypot flow traction server side draws the flow to an appointed target honeypot node according to the configuration items;

after receiving the flow, the honeypot node responds, sends the generated response flow to a honeypot flow server, and sends the response flow to a honeypot flow terminal through a tunnel; after receiving the flow, the honeypot flow traction terminal writes the response flow back to the virtual network card, performs source address conversion by the SNAT conversion method, and sends the response flow to a flow initiator;

recording the quintuple and the corresponding virtual network card equipment when the server ingress;

and writing the virtual network card equipment by inquiring the mapping table in the step A when the server is egr.

9. A computer device comprising a plurality of computer devices, each computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processors of the plurality of computer devices when executing the computer program collectively implement the steps of the honeypot flow pulling method of claim 8.

10. A computer-readable storage medium, on which a computer program is stored, which, when being executed by a processor, carries out the steps of the honeypot flow pulling method of claim 8.

Images