CN103440454B - A kind of active honeypot detection method based on search engine keywords - Google Patents

Abstract

The invention discloses an active honeypot detection method based on search engine keywords. First, a known malicious search engine keyword database is used to automatically construct a corresponding honeypot web page: for malicious search engine keywords targeting URL paths, Use Apache? HTTP? The address rewriting technology of the server engine constructs the corresponding honeypot webpage; for malicious search engine keywords targeting the webpage content, re-enter the keywords into the search engine, and use the returned webpage results as the honeypot webpage. Secondly, include the honeypot webpage in the search engine. Finally, according to the malicious access records of honeypot webpages, data mining algorithms are used to extract new malicious search engine keywords, and incorporate them into the malicious search engine keyword database to reconstruct new honeypot webpages. The invention greatly improves the detection efficiency of the honeypot, makes up for the passive defect of the traditional honeypot; and dynamically updates the webpage of the honeypot to obtain the latest hacker attack vulnerability information.

Description

An active honeypot detection method based on search engine keywords

technical field

The invention relates to an active honeypot detection method, in particular to an active honeypot detection method based on search engine keywords.

Background technique

Hacker attacks are often based on the discovery of certain loopholes in the system or network, and new attack methods will always be generated for new loopholes. In order to test new loopholes and attack methods, hackers often use search engines to search for websites that may have certain loopholes on the Internet and attack them. There are also hackers who have written a specific scanning and automatic intrusion tool for a certain vulnerability, and conduct large-scale scanning and intrusion on all websites on the Internet that may have such a vulnerability through search engines. In recent years, hacking using search engines has become an important means of hacking.

A honeypot is a decoy system containing vulnerabilities, which is specially designed to attract and entrap those hackers. By simulating one or more vulnerable hosts, it provides hackers with an easy target to attack. Since the honeypot does not provide a truly valuable service to the outside world, all attempts at honeypots are considered suspicious. Another use of honeypots is to delay the attack on the real target in an attack, allowing hackers to waste time on honeypots.

Honeypots are divided into real system honeypots and pseudo system honeypots. A real system honeypot is a real honeypot, which runs a real system and has real hackable loopholes, which are the most dangerous loopholes; and the intrusion information it records is the most authentic. The fake system honeypot is also based on the real system. It uses the powerful imitation ability of some tool programs to forge vulnerabilities that do not belong to it. Invading such a loophole is just going around in a program framework. Honeypots can prevent intruders from damaging to the greatest extent, and can also simulate non-existent vulnerabilities to confuse hackers.

If the corresponding honeypot can be simulated according to the hacker's search keywords, deployed on the Internet, and searched by well-known search engines, combined with search engine algorithm optimization technology, the honeypot can be displayed to the hacker to lure the hacker to attack, then the initiative can be achieved. The purpose of attracting hackers' attacks greatly improves the detection effect of the honeypot, and in this way, the honeypot can be continuously updated according to the new hacker search keywords that appear every day, so as to ensure that the content of the honeypot is synchronized with the hacker's attack methods.

Therefore, those skilled in the art are committed to developing an active honeypot detection method based on search engine keywords to make up for the passive waiting shortcomings of traditional honeypots, and to better actively lure hackers to attack and continuously update honeypots content to keep it up to date with the latest hacking techniques.

Contents of the invention

In view of the above-mentioned defects in the prior art, the technical problem to be solved by the present invention is to provide an active woodwind detection method based on search engine keywords.

To achieve the above object, the invention provides a kind of active honeypot detection method based on search engine keywords, it is characterized in that, comprises the following steps:

Step (101) utilizing the collected and identified malicious search engine keyword database to automatically construct a honeypot webpage;

Step (102) including the constructed honeypot webpage in a search engine through search engine ranking optimization technology, and improving the ranking of the honeypot webpage in the search engine to actively attract hackers to visit;

Step (103) using a data mining algorithm to extract new malicious search engine keywords from the access records of the honeypot webpage, and incorporating the extracted new malicious search engine keywords into the malicious search engine keyword database , jump back to step (101).

Further, in the step (101), the malicious search engine keyword database includes malicious search engine keywords for URL paths and malicious search engine keywords for web page content.

Further, for the malicious search engine keyword for the URL path, the honeypot webpage is constructed by using address rewriting technology.

Further, wherein, the address rewriting technology uses ApacheHTTPServer engine.

Further, for the malicious search engine keyword for the webpage content, the malicious search engine keyword is searched again on the search engine, and the searched webpage is processed as the honeypot webpage.

Further, the search engine ranking optimization technology includes registering high-reputation domain names, increasing links and optimizing web page content.

Further, the step (103) also includes distinguishing between normal access and malicious attack in the web page access records.

Further, the access records of the honeypot webpage are divided into engine crawlers, the normal access and the malicious attacks; wherein the engine crawlers also belong to the malicious attacks.

Further, in the step (103), all accesses whose HTTP response code is not 200 are taken as the malicious attack.

Further, the data mining algorithm extracts the new malicious search engine keywords through HTTPReferrer information.

In a preferred embodiment of the present invention, at first, adopt two kinds of methods to construct the virtual honeypot webpage by the recently identified malicious search engine keyword library that is popular on the Internet: for the malicious search engine keyword aiming at the URL path, utilize The engine uses address rewriting technology to construct honeypot webpages; for malicious search engine keywords targeting webpage content, query these keywords again on the search engine, and process the returned webpages as corresponding honeypot webpages. Secondly, through search engine ranking optimization technology, these simulated honeypot webpages are indexed by search engines, and their rankings are improved to actively attract hackers. Finally, data mining algorithms are used to distinguish different malicious attacks and normal access records in the traffic, so as to analyze the purpose and steps of the latest attack behavior of hackers, extract new malicious search engine keywords, and incorporate new malicious search engine keywords into malicious The search engine keyword database is used to dynamically update the malicious search engine keywords, and then the honeypot webpage can be dynamically updated according to the dynamically updated malicious search engine keyword database, and so on and on.

An active honeypot detection method based on search engine keywords of the present invention greatly improves the detection efficiency of honeypots by actively attracting hackers to attack, and makes up for the passive shortcomings of traditional honeypots; and the method of the present invention uses dynamically updated honeypots. Jar webpage to obtain the latest hacker attack vulnerability information to mine malicious attack behavior in data traffic and analyze the characteristics of the latest hacker attack behavior.

The idea, specific structure and technical effects of the present invention will be further described below in conjunction with the accompanying drawings, so as to fully understand the purpose, features and effects of the present invention.

Description of drawings

Fig. 1 is a kind of flow chart of the active type honeypot detection method based on search engine keyword of the present invention;

Fig. 2 is a honeypot system architecture diagram of an active honeypot detection method based on search engine keywords in the present invention.

detailed description

Below in conjunction with accompanying drawing, the embodiment of the present invention is described in detail: present embodiment implements under the premise of the technical scheme of the present invention, has provided detailed implementation and specific operation process, but protection scope of the present invention is not limited to the following the embodiment.

In the present embodiment, as shown in Figure 1, a kind of active honeypot detection method based on search engine keyword of the present invention comprises the following steps:

Step 101: Utilize the collected and identified malicious search engine keyword database to automatically construct a honeypot webpage, as shown in Figure 2:

Classify and identify the searched and identified malicious search engine keyword database: malicious search engine keywords are divided into malicious search engine keywords targeting the URL (UniformResourceLocator) path of the webpage and malicious search engine keywords targeting webpage content.

For malicious search engine keywords targeting the URL path, the search engine using Apache HTTP Server adopts URLRewrite technology, that is, address rewriting technology to construct honeypot web pages. URLRewrite is also the redirection of addresses. URLRewrite technology is the process of intercepting incoming user requests and automatically redirecting the requests to other resources. The way the server works when handling user requests has not changed, only the process of redirecting requests has been added. In the present invention, the URLRewrite technology redirects it to the corresponding honeypot webpage according to the malicious search engine keywords of the existing URL path.

For malicious search engine keywords aimed at webpage content, query these malicious search engine keywords again, and store the webpage content of the search results in the local Apache WEB server as the corresponding honeypot webpage.

Step 102: Include the constructed honeypot webpage in a search engine through search engine ranking optimization technology: improve the ranking of the honeypot webpage in the search engine to actively attract hackers to visit. Use search engine optimization techniques such as registering high-reputation domain names, increasing links, and optimizing web content to make honeypot web pages indexed by search engines and further improve their rankings, making them more attractive to hackers.

Step 103: adopt the following algorithm to extract malicious search engine keywords from the webpage access records:

The first step is to distinguish between normal visits and malicious attacks recorded on webpages: when honeypot webpages are indexed by search engines, hackers can search for these honeypot webpages through malicious search engine keywords and attack them. Record all visits to honeypot web pages, and dig out hacker attacks from them. Because the links of the honeypot web pages are all hidden links in the website, users cannot see them, but such links can be found for hackers' attack tools. In the honeypot access records, as shown in Figure 2, in addition to normal access, it also includes two types of access: attack 201 and malicious search 203; in addition, there are search engine-specific User Agent (UserAgent) and source IP The address identifies crawlers 202 from well-known search engines. Therefore, all situations other than normal visits to honeypot webpages will be identified as malicious attacks. In addition, in view of the phenomenon that attackers may try to access some system sensitive resource paths, since the access with HTTP response code 200 is normal, all accesses with HTTP response code not 200 are listed as malicious attacks.

The second step is to record the source of the malicious attack, use the recorded source of the attack as a database, use the data mining algorithm to create a data mining model for the database of the recorded attack source, and then perform classification analysis to extract new malicious searches Engine keywords: HTTPReferrer, that is, the HTTP source address, is a field in the HTTP header, used to indicate where to link to the current web page, and the format used is URL. With HTTPReferrer, the current webpage can check where visitors come from; therefore, through HTTPReferrer information, new malicious search engine keywords that hackers may use to access honeypot webpages can be extracted.

After the new malicious search engine keywords are extracted, add the extracted new malicious search engine keywords to the malicious keyword database, jump to step 101, and reconstruct a new honeypot webpage, so as to dynamically update the honeypot webpage the goal of.

The preferred specific embodiments of the present invention have been described in detail above. It should be understood that those skilled in the art can make many modifications and changes according to the concept of the present invention without creative efforts. Therefore, all technical solutions that can be obtained by those skilled in the art based on the concept of the present invention through logical analysis, reasoning or limited experiments on the basis of the prior art shall be within the scope of protection defined by the claims.

Claims (1)

1. an active honeypot detection method based on search engine keywords, is characterized in that, comprises the following steps: Step (101) utilizes collected and identified malicious search engine keyword database to automatically construct a honeypot webpage; Step (102) includes the honeypot webpage constructed into a search engine by search engine ranking optimization technology, and improves the ranking of the honeypot webpage in the search engine to actively attract hackers to visit; Step (103) using a data mining algorithm to extract new malicious search engine keywords from the access records of the honeypot webpage, and incorporating the extracted new malicious search engine keywords into the malicious search engine keyword library , jump back to step (101); In the step (101), the malicious search engine keyword database includes malicious search engine keywords for URL paths and malicious search engine keywords for webpage content; For the malicious search engine keywords aimed at the URL path, the honeypot webpage is constructed using address rewriting technology; What described address rewriting technology used is AppacheHTTPServer engine; For the malicious search engine keywords aimed at webpage content, search for the malicious search engine keywords again on the search engine, and process the searched webpages as the honeypot webpages; The search engine ranking optimization technique includes registering a high-reputation domain name, increasing links and optimizing webpage content; the step (103) also includes distinguishing normal visits and malicious attacks in the honeypot webpage access records; The access records of the honeypot webpage are divided into engine crawlers, the normal visit and the malicious attack; wherein the engine crawler also belongs to the malicious attack; In the step (103), all HTTP response codes are not 200 visits as the malicious attack; The data mining algorithm extracts the new malicious search engine keywords through the HTTPReferrer information.