A method to determine the attack path of lateral movement in honeynet based on the analysis of attack behavior

Abstract

The present invention provides a method for determining a lateral movement attack path in a honeynet based on attack behavior analysis, which relates to the technical field of honeypots and includes the following steps: S1: deploying multiple honeypots to form a honeynet environment; Clean and preprocess all the honeypot attack data received; S3: store all honeypot attack data processed in step S2 in the database for persistent storage; S4: determine whether the attack source of the attack data is in the honeynet environment If it is not in the honeynet environment, the current honeypot is the entry honeypot for the attacker to enter the honeynet environment; if it is in the honeynet environment, the current honeypot has an upstream springboard honeypot; S5: Combine all honeypots Correlation analysis is performed on the attack data; the attack path provided by the invention is completely determined according to the actual situation of the attacker moving laterally in the honeynet, and the possible attack path is not preset, which is more flexible and accurate than the prior art.

Description

technical field [0001] The invention relates to the field of honeypot technology, in particular to a method for determining a lateral movement attack path in a honeynet based on attack behavior analysis. Background technique [0002] Honeypot technology generally pretends to be a vulnerable network service and responds to the attack connection. It can be used to deceive the attacker, increase its attack cost, and monitor it. In practical applications, multiple honeypots are usually built in the same network to form a honeynet, which provides a real and rich business environment for attackers and increases the difficulty of identifying attackers. [0003] After the attacker enters the honeynet system, the next step is to carry out lateral movement attacks to find valuable resources. In order to better monitor the attacker and identify the attacker's attack intention and target, it is necessary to know Lateral movement attack paths within the network. [0004] Patent documen...

AI Technical Summary

Problems solved by technology

[0005] However, the attack behavior determination method provided by the above-mentioned patent document CN108234400A is too rigid, and it is necessary to preset possible attack paths. When the access path does not exist in the preset library, the access path cannot be clarified; As far as the honeynet is concerned, lateral movement attacks are being carried out, and it is impossible to identify the respective attack paths of multiple attackers through the time axis

Images