CN116192506A - Active spoofing defending method, system, device and storage medium for cloud-originated application - Google Patents

Abstract

The invention discloses a cloud native application active spoofing defending method, a cloud native application active spoofing defending system, a cloud native application active spoofing defending device and a cloud native application active spoofing defending storage medium, and belongs to the technical field of sandboxes. Comprising the following steps: s100, detecting a current attack path of an attacker, and analyzing a current attack source and fingerprint information of the attacker; s200, judging whether a business system attacked by an attacker is first attack or not according to the current attack source and fingerprint information; if yes, S300, extracting an attack source and fingerprint information of an attacker into a sandbox mirror image file of the simulated service system; if not, S400, introducing the attack flow of the attacker into the mirror image of the simulated service system to isolate the attack. The sandbox is combined with the actual service, and the high-interaction production environment sandbox is automatically constructed in real time through attack perception of the production environment, so that the current situation that the sandbox is isolated from the production environment is broken, and the sandbox is isolated from the actual service through combination of a K8S network strategy, so that the sandbox and the actual service are logically isolated.

Description

Active deception defense method and system, device and storage medium for cloud-native applications

technical field

The present invention relates to the field of sandbox technology, and in particular to a cloud native application active deception defense method, system, device and storage medium.

Background technique

Currently, spoofing defense is a more commonly used technology in active defense. By simulating the production system to generate a sandbox to capture the behavior of attackers, it turns passive defense into active perception. Sandboxes are generally divided into seven-layer sandboxes (OSI network protocol data link layer) and four-layer sandboxes (OSI network protocol transport layer). This technology on the market has deficiencies in defense, that is, the generated sandbox is separated from the production environment, and can only passively perceive attacks against the sandbox, but cannot perceive real attacks in the business system corresponding to the sandbox. That is, the sandbox is completely independent from the production environment. In addition, most sandbox addresses are static, and once the sandbox is identified and marked by an attacker, it is easy to bypass. Attackers can directly attack real business systems, while the sandbox completely loses its defensive effect.

Contents of the invention

In order to overcome the above technical problems, the present invention provides a cloud-native application active deception defense method, system, device and storage medium. This function combines the sandbox with the actual business. Through the attack perception of the production environment, it automatically builds a high-interaction production environment sandbox in real time and simulates the real production environment, thus breaking the current situation of isolation between the sandbox and the production environment. By combining the K8S network strategy, Isolate the sandbox from the actual business to ensure the logical isolation of the two; the K8S cloud-native network strategy is not limited by physical hardware, simplifies logical processing, is scalable, and responds quickly.

In order to solve the above problems, the technical solution provided by the invention is:

A cloud native application active deception defense method, comprising: S100, detecting the current attack path of the attacker, and analyzing the current attack source and fingerprint information of the attacker; S200, judging the attack direction of the attacker according to the current attack source and fingerprint information Whether the business system is attacked for the first time; if so, then S300, extract the attacker's attack source and fingerprint information into the sandbox image file of the simulated business system; if not, then S400, introduce the attacker's attack traffic into the simulated business In the image of the system, the attack is isolated.

Optionally, in the S400, the built-in namespace (namespace) and cgroups (process isolation) technologies isolate attacks.

Optionally, in S100, when the attacker attacks the service system, the attack source of the attack data and the attacked service system are distinguished through "source IP/source port->destination IP/destination port".

Optionally, in the S300, a sandbox image is automatically built, traffic forwarding is performed, and the attacker's traffic is forwarded to the sandbox image.

Optionally, in the S300, the fingerprint information of the attacker is created through environment variable configuration, and a sandbox image file is constructed.

Optionally, it also includes, in S300, initializing the container, and initializing the database dependent on the sandbox image file.

An active deception defense system for cloud-native applications, including: a detection unit for detecting the current attack path of an attacker, and analyzing the current attack source and fingerprint information of the attacker; an attack count judgment unit for and fingerprint information to determine whether the business system attacked by the attacker is the first attack; the sandbox mirroring unit is used to extract the attacker’s attack source and fingerprint information into the sandbox mirror file of the simulated business system; the isolation unit uses The attacker's attack traffic is introduced into the mirror of the simulated business system to isolate the attack.

Optionally, the sandbox mirroring unit is also used for initializing the container and initializing the database on which the sandbox mirroring file depends.

A cloud native application active deception defense device, the device includes: one or more processors; memory, used to store one or more programs, when the one or more programs are processed by the one or more When the processor is executed, the one or more processors are executed to perform the method as described above.

A storage medium storing a computer program, when the program is executed by a processor, the method described in any one of the above is implemented.

Compared with the prior art, the technical solution provided by the invention has the following beneficial effects:

By simulating the customer's real business system image file, it is used to automatically build a sandbox image, and based on judging whether the attacker is the first attack, the attack traffic is forwarded to the sandbox, so that the attack business is isolated from the real business.

Description of drawings

Fig. 1 is a flowchart of an active deception defense method for cloud native applications provided by an embodiment of the present invention.

Fig. 2 is a flow chart of obtaining attacker's attack source and attack port information according to an embodiment of the present invention.

Fig. 3 is a flow chart of forwarding traffic to each container through a configuration file according to an embodiment of the present invention.

FIG. 4 is a flowchart of a method for automatically and quickly building an image file according to an embodiment of the present invention.

Fig. 5 is a flow chart of an active deception defense method for a cloud-native off-premises application according to an embodiment of the present invention.

FIG. 6 is a flow chart of an active deception defense method for cloud-native off-premises applications according to an embodiment of the present invention.

FIG. 7 is a schematic structural diagram of an active deception defense system for cloud-native off-premises applications provided by an embodiment of the present invention.

FIG. 8 is a schematic structural diagram of an active deception defense device for cloud-native off-premises applications provided by an embodiment of the present invention.

Detailed ways

In order to further understand the content of the present invention, the present invention will be described in detail in conjunction with the accompanying drawings and embodiments.

The application will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain related inventions, rather than to limit the invention. It should also be noted that, for ease of description, only parts related to the invention are shown in the drawings. The first, second and other words mentioned in the present invention are set for the convenience of describing the technical solution of the present invention, and have no specific limiting role, and all refer to them in general, and do not constitute a limiting role to the technical solution of the present invention. It should be noted that, in the case of no conflict, the embodiments in the present application and the features in the embodiments can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and embodiments.

Example 1

As shown in Figure 1, a server cloud native application active deception defense method on the k8s cloud includes:

S100. Detect the current attack path of the attacker, and analyze the current attack source and fingerprint information of the attacker;

S200. According to the current attack source and fingerprint information, determine whether the business system attacked by the attacker is the first attack;

If so, then S300, extracting the attacker's attack source and fingerprint information into the sandbox image file of the simulated business system;

If not, then S400. Introduce the attacker's attack traffic into the mirror of the simulated service system to isolate the attack.

The same sandbox image file as the business system is pre-built under the customer's business system. After the real business system is invaded, the sandbox image file of the simulated business system will be automatically created as an isolation environment, leading the attacker to the isolation environment. environment without affecting real business. By simulating the customer's real business system image file to automatically build a sandbox image, based on judging whether the attacker is the first attack, forward the attack traffic to the sandbox, so as to isolate the attack business from the real business.

As an optional implementation solution, in the S400, the built-in namespace (name space) and cgroups (process isolation) technologies isolate attacks.

As an optional implementation solution, in S100, when the attacker attacks the business system, the attack source of the attack data and the attacked business system are distinguished through "source IP/source port -> target IP/target port".

As an optional implementation solution, in the S300, a sandbox image is automatically built to forward traffic, and the attacker's traffic, that is, the attack source, is forwarded to the sandbox image.

As an optional implementation solution, in the S300, the attacker's fingerprint information is created through environment variable configuration, and a sandbox image file is constructed.

As an optional implementation solution, it also includes, in S300, initializing the container and initializing the database dependent on the sandbox image file.

Example 2

As shown in FIG. 7 , this embodiment provides an active deception defense system for cloud-native off-premises applications, including:

The detection unit is used to detect the current attack path of the attacker, and analyze the current attack source and fingerprint information of the attacker;

The number of attacks judging unit is used to judge whether the business system attacked by the attacker is the first attack according to the current attack source and fingerprint information;

The sandbox image unit is used to extract the attacker's attack source and fingerprint information into the sandbox image file of the simulated business system;

The isolation unit is used to introduce the attacker's attack traffic into the image of the simulated business system to isolate the attack.

As an optional implementation, the sandbox mirroring unit is also used for initializing the container and initializing the database on which the sandbox mirroring file depends.

Example 3

As shown in Figure 5, the basic process is:

Step 1, detect the attacker's current attack path; analyze the attacker's current attack IP (network address) and fingerprint information;

Step 2, according to the current attack IP (network address) and fingerprint information, determine whether the business system attacked by the attacker is the first attack?

If yes, step 3, extract the attacker's attack source and fingerprint information into the sandbox image file of the simulated business system by simulating the sandbox image file of the business system

If not, go directly to step 4, importing the attacker's attack traffic into the image of the simulated business system, and the built-in namespace (namespace) and cgroups (process isolation) technology will isolate the attack.

The specific process is, in Figure 2, when the attacker attacks the business system, he distinguishes the attack source of the attack data and the attack business according to "source IP/source port -> target IP/target port".

In Figure 2, the source IP: 1.2.3.4: is the IP address of the attacker; the destination IP: 10.0.0.1: 80, is the IP address of the attack target. The container in Figure 2 refers to the sandbox image, Kube-proxy (network proxy) There are container 1 and container 2 on node 1; there are container 3 and container 4 on node 2 of Kube-proxy (network proxy). Depending on the selected mode, when attacked, you can choose to introduce the attack source into container 1 and container 2 on node 1, or container 3 and container 4 on node 2 for isolation.

In Figure 3, to detect the current system configuration, add the externalTrafficPolicy (external traffic policy) configuration to the server (server) configuration, and assign the pod (mirror) to a certain node. When accessing, directly configure nodeip (node address): serveri-port (access channel port) to access to obtain the real IP of the attacker.

In the Service object of k8s (declare an access channel), set the externalTrafficPolicy field, in which there are 2 values that can be set: Cluster (traffic can be forwarded to Pods on other nodes) or Local (traffic is only sent to local Pods).

Figure 3, when selecting Cluster, Kube-proxy (network proxy) will replace the source IP of the message when forwarding. That is: the source IP address of the packet received by the container has been replaced by the previous forwarding node. After configuring Local, Kube-proxy will retain the source IP when forwarding. That is, the source IP address of the packet received by the container still belongs to the attacker. Therefore, in the configured sandbox image file, configuring externalTrafficPolicy can complete the acquisition of the attacker's source address or node address. The local node can obtain the source IP address and forward the node IP address.

In Figure 4, judge whether it is the first attack, if so, based on the service image, Dockerflie (mirror text), clone (clone business file) service image, rewrite Dockerflie (mirror text), perform Docker-build (mirror creation), and form Sandbox mirroring, realizes automatic pipeline deployment of sandbox mirroring, and quickly builds sandbox mirroring within 15 seconds (experimental time). Automatically package and push the sandbox image file to the sandbox node, as shown in Figure 2-3, to the container of node 1 or node 2, and repeat the above-mentioned automated pipeline deployment process. If not, forward the attack traffic directly to the sandbox mirror. Rewrite the mirrored text by cloning the business file of the real production system to prevent the original mirrored text from being damaged, so as to avoid problems when it needs to be used. Therefore, it is necessary to clone the business file and rewrite the mirrored text so that the original mirrored text will not be affected. .

In Figure 5, based on the acquisition of attacker-related information in ETCD (database):

1) When building a sandbox image file, configure it through env (environment variable), so that the attacker's fingerprint information (user, password, database and specified character encoding, etc.) can be created when creating it.

2) By configuring the init (initialization) container to complete the implementation of the image-dependent database and users. Mount the sql (database) statement into the configmap (mount file) in the init container to complete the function of executing the sql statement in the init container, and at the same time complete the initialization of the database dependent on the sandbox image file. That is, the database matching shown in Fig. 5 .

The API-server interface server reads data from ETC D. The database stores existing data, attacker’s attack source fingerprint information, ip, etc., for forwarding selection.

After obtaining the attack source and fingerprint information of the attacker in Figure 5:

1) Construct the init container and database to store attacker-related information, and make matching judgments based on the attacker's ip and fingerprint information stored in the database when the attacker attacks.

2) Determine whether the attacker is attacking for the first time. If so, build a sandbox image through jenkins, as shown in Figure 4, Kube-proxy (network proxy) forwards traffic, and forwards the attacker's traffic to the sandbox image.

3) If it is a secondary attack or above, Kube-proxy will be used to automatically forward the traffic into the sandbox image, and namespace and cgroups will be used to isolate the attack, and the attack traffic will be isolated into the sandbox image to prevent the real business system from being attacked destroyed.

Node 1 (business area) in Figure 5 is the real business system, and the node where the production system is located has several sandbox images, namely container 1 and container 2 in Figure 5. Node 2 (sandbox area) arranges several sandboxes, respectively copying container 1 and container 2 of node 1, that is, sandbox 5 (container 1 copy), sandbox 6 (container 2 copy), and when selecting Cluster, execute Sandbox 3 (container 1 copy) and sandbox 4 (container 2 copy) obtained by the method in the box in Figure 4, that is, clone the business file corresponding to the image text of node 1 (business area), rewrite the image text, and create the image. Form a sandbox image.

Step 1 in Figure 5: Source IP: 1.2.3.4 The traffic arriving at the node, via the Api-server, reaches the destination ip: 10.0.0.1: node 1 (service area) at port 80; Kube-proxy (network proxy) executes the method in Figure 3 , if Local is selected, step ②, execute the method steps in Figure 4, and create container 1 and container 2; if Cluster is selected, step ③, the method steps in Figure 4, create sandbox 3 in node 2 (sandbox area) (container 1 copy) and sandbox 4 (container 2 copy); step ④ in Figure 5 directly copies container 1 and container 2 of node 1 (business area) to form sandbox 5 (container 1 copy), sandbox 6 (container 2 copy).

In Figure 6, the attacker obtains the attack source, determines the attack service, configures the image file, and stores it in the database; the attacker obtains the attack source, matches the database, and judges whether it is the first attack. The fingerprint information of the attacker, the attack business, etc. are matched with the database and stored in the database; at the same time, Jenkins automatically builds a mirror, forms a sandbox mirror, forwards traffic, and forwards it to the sandbox mirror. If it is not the first attack, if it is a second attack, or more than two attacks, the traffic will be forwarded and forwarded to the sandbox mirror. Among them, Jenkins is a continuous integration tool, which is mainly used for continuous and automatic construction of projects. In this embodiment, Jenkins is used for automatic construction of sandbox images.

Example 4

A cloud native application active deception defense device, the device includes: one or more processors; memory, used to store one or more programs, when the one or more programs are processed by the one or more When the processor is executed, the one or more processors are executed to perform the method as described above.

A storage medium storing a computer program, which implements the methods described in Embodiments 1 and 3 above when the program is executed by a processor.

As shown in FIG. 8 , as another aspect, the present application also provides a device, including one or more central processing units (CPUs), which can be stored in the read-only memory (ROM) 502 according to the program or from the memory The program loaded into the random access memory (RAM) 503 by the part 508 executes various appropriate actions and processes. In RAM 503, various programs and data necessary for device operation are also stored. The CPU, ROM 502 , and RAM 503 are connected to each other via a bus 504 . An input/output (I/O) interface 505 is also connected to the bus 504 .

The following components are connected to the I/O interface 505: an input section 506 including a keyboard, a mouse, etc.; an output section 507 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker; a storage section 508 including a hard disk, etc. and a communication section 509 including a network interface card such as a LAN card, a modem, or the like. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the I/O interface 505 as needed. A removable medium 511, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is mounted on the drive 510 as necessary so that a computer program read therefrom is installed into the storage section 508 as necessary.

In particular, according to the embodiments disclosed in this application, the method described in any of the above embodiments can be implemented as a computer software program. For example, the embodiments disclosed in this application include a computer program product, which includes a computer program tangibly contained on a machine-readable medium, where the computer program includes program code for executing the method described in any of the above embodiments. In such an embodiment, the computer program may be downloaded and installed from a network via communication portion 509 and/or installed from removable media 511 .

As yet another aspect, the present application also provides a computer-readable storage medium, which may be the computer-readable storage medium contained in the device of the above-mentioned embodiment; computer readable storage medium in the device. The computer-readable storage medium stores one or more programs, and the programs are used by one or more processors to execute the methods described in this application.

The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, program segment, or portion of code that contains one or more logical functions for implementing specified executable instructions. It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or they may sometimes be executed in the reverse order, depending upon the functionality involved. It is also to be noted that each block of the block diagrams and/or flowchart illustrations, and combinations of blocks in the block diagrams and/or flowchart illustrations, can be implemented by a dedicated hardware-based system that performs the specified functions or operations , or can be implemented by a combination of dedicated hardware and computer instructions.

The units or modules involved in the embodiments described in the present application may be implemented by means of software or by means of hardware. The described units or modules may also be set in a processor, for example, each of the units may be a software program set in a computer or mobile smart device, or may be a separately configured hardware device. Wherein, the names of these units or modules do not constitute limitations on the units or modules themselves under certain circumstances.

The above description is only a preferred embodiment of the present application and an illustration of the applied technical principle. Those skilled in the art should understand that the scope of the invention involved in this application is not limited to the technical solution formed by the specific combination of the above-mentioned technical features, and should also cover the technical solutions formed by the above-mentioned technical features or Other technical solutions formed by any combination of equivalent features. For example, a technical solution formed by replacing the above-mentioned features with technical features with similar functions disclosed in (but not limited to) this application.

Claims (10)

1. A cloud native application active deception defense method, characterized in that, comprising: S100. Detect the current attack path of the attacker, and analyze the current attack source and fingerprint information of the attacker; S200. According to the current attack source and fingerprint information, determine whether the business system attacked by the attacker is the first attack; If so, then S300, extracting the attacker's attack source and fingerprint information into the sandbox image file of the simulated business system; If not, then S400. Introduce the attacker's attack traffic into the mirror of the simulated service system to isolate the attack. 2. The cloud native application active deception defense method according to claim 1, characterized in that, in the S400, the built-in namespace (namespace) and cgroups (process isolation) technologies isolate attacks. 3. The cloud native application active deception defense method according to claim 1, characterized in that, in S100, when the attacker attacks the business system, through "source IP/source port->target IP/target port "Distinguish the attack source of the attack data and the business system of the attack. 4. The cloud native application active deception defense method according to claim 1, characterized in that in S300, a sandbox image is automatically built, traffic forwarding is performed, and the attacker's traffic is forwarded to the sandbox image. 5. A cloud native application active deception defense method according to claim 1, characterized in that in S300, the attacker's fingerprint information is created through environment variable configuration, and a sandbox image file is constructed. 6 . The cloud-native off-premises application active deception defense method according to claim 1 , further comprising, in S300 , initializing the container and initializing the database on which the sandbox image file depends. 7. A cloud native application active deception defense system, characterized in that it includes: The detection unit is used to detect the current attack path of the attacker, and analyze the current attack source and fingerprint information of the attacker; The number of attacks judging unit is used to judge whether the business system attacked by the attacker is the first attack according to the current attack source and fingerprint information; The sandbox image unit is used to extract the attacker's attack source and fingerprint information into the sandbox image file of the simulated business system; The isolation unit is used to introduce the attacker's attack traffic into the image of the simulated business system to isolate the attack. 8. The cloud native application active deception defense system according to claim 7, wherein the sandbox mirroring unit is also used for initializing the container and initializing the database on which the sandbox mirroring file depends. 9. A cloud native application active deception defense device, characterized in that the device includes: one or more processors; memory for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors are caused to execute the method according to any one of claims 1-6. 10. A storage medium storing a computer program, wherein when the program is executed by a processor, the method according to any one of claims 1-6 is implemented.

Images