CN108521426B - A blockchain-based array honeypot collaborative control method - Google Patents

Abstract

The invention relates to a blockchain-based array honeypot collaborative control method. The method utilizes the Ethereum platform to construct a private chain, and realizes the idea of decentralized collaborative operation of a honeypot host cluster through a mining method. Starting from the P2P networking model, a topology structure consistent with the Ethereum platform is constructed, and the communication between the two is realized through web3J. Each host in the array performs mining, and the host that obtains the accounting right can serve as the transformation task of the honeypot service within a certain period of time, send transformation information through the encryption mechanism, and other hosts receive and execute the corresponding transformation instructions. In addition, the information of the blockchain cannot be tampered with, and the external port request access data is stored in the blockchain for digital forensics for attackers to carry out attacks. The method ensures the cooperative operation of the array honeypot host cluster, so as to deceive the attacker with the dynamically changing real and fake services, and realize the purpose of active network security defense.

Description

A blockchain-based array honeypot collaborative control method

technical field

The invention relates to a decentralization method for a network active defense system, in particular to a blockchain-based array honeypot collaborative control method. Starting from the blockchain's P2P networking model, the array deceives the distribution of honeypot hosts. It belongs to the field of network security technology.

Background technique

In the network attack and defense confrontation in the information age, the defender has adopted various strategies to protect the system. Among them, the deceptive honeypot technology is more proactive than traditional defense measures. By constructing false vulnerabilities, services, resources Waiting to lure attackers, achieve the purpose of consumption attack, and then protect the real system. However, static honeypots can be easily detected by adversaries, allowing adversaries to avoid the trap and attack the protected system. Therefore, enhancing the dynamics of honeypots helps to improve the anti-recognition ability.

By constructing a honeypot system of array transformation, dynamic trapping attacks are realized, and real service resources are dynamically protected. The system's dynamic transformation strategy improves the degree of confusion for attackers, making it impossible for attackers to distinguish between true and false array systems. Honeypot and real system, even if the adversary realizes the identification of a host in the honeypot system at a certain moment t ₀ , due to the existence of the dynamic transformation mechanism (true to false, false to true), the attack identification will be performed at the next moment. t ₁ becomes the protective identification of the honeypot system, that is, the attacker will bypass the host identified as the honeypot service at t ₀ at time t ₁ , and at this moment the host has been transformed into a real service, so as to achieve the purpose of protecting the real service. .

In view of the distributed characteristics of the array honeypot system, it is necessary to ensure the coordinated operation of internal hosts to realize automatic operation. However, in the traditional centralized mechanism, a specific host provides central control to determine the specific transformation plan at a certain moment, and the other hosts receive and execute the central host transformation instructions in subordinate roles. Under this centralized control mechanism, if a specific central server goes down, the entire honeypot system of the array will be paralyzed, causing great losses to the defender.

SUMMARY OF THE INVENTION

In order to avoid the destructive consequences caused by the central control mechanism, in order to ensure the normal operation of the system and improve the robustness of the system, the present invention adopts the decentralized collaborative control mechanism based on the blockchain to realize the automatic operation of each host in the array honeypot system. Under this mechanism, even if a server fails, it will not affect the overall running state of the system. Deploy the smart contracts in the blockchain in a private chain composed of multiple array hosts, and achieve the goal of automated instruction execution without central control that conforms to the business logic of the array honeypot system through the code on the chain, that is, the decentralization of the array host cluster. Coordinated control mechanism.

In order to achieve the above purpose, a blockchain-based array honeypot collaborative control method is proposed, which mainly includes the following steps:

(1) Under the Ethereum platform, use the genesis block file to build a private chain composed of n hosts within the array, namely priChain={host ₀ ,host ₂ ,...,host _n-1 };

(2) In n hosts, build a distributed dynamic array honeypot system with active defense function, namely honArray={sys ₀ ,sys ₂ ,...,sys _n-1 };

(3) Deploy smart contracts on priChain that conform to the decentralized business logic of the array honeypot system;

(4) Create an Ethereum account account={ac ₀ ,ac ₂ ,...,ac _n-1 }, and perform mining;

(5) For the service host host _i corresponding to the successful mining account ac _i , its authenticity is verified by the other n-1 hosts host _j in the private chain of the array honeypot, where j≠i;

(6) The honeypot host host _i that actually successfully mines realizes the information transmission with the array honeypot system sys _i through the Ethereum platform interface;

(7) The host _i of the array honeypot system that has received the successful mining instruction will be responsible for changing the specific information distribution task of the service in the future T time period;

(8) After T period, a new round of mining operations is performed, and other hosts host _i with accounting rights different from host _i are selected, where j≠i, execute a cycle, and implement the services of each host of the array honeypot Transform assignments.

A further technical solution of the present invention is that before using the creation file to build a private chain, data adjustment needs to be performed on the JSON type file, that is, the internal difficulty (difficulty value) parameter needs to be modified, and the mining is enabled by adjusting the difficulty value. The time interval T is within a reasonable range, so that the change period of the service hosts in the array honeypot system is in the best defense stage.

A further technical solution of the present invention is that, when constructing a distributed array honeypot system, a P2P network architecture with equal status between nodes is established, and the architecture ensures the role equality of all hosts in the array, that is, each host It acts as both a communication server and a communication client, and achieves peer-to-peer interoperability with the Ethereum platform.

A further technical solution of the present invention is that, in the honeypot system host that has successfully mined, sending transformation instructions to other hosts in the array, using RSA asymmetric encryption mechanism to ensure information concealment, the instruction sender implements RSA encryption, and after transmission encryption The ciphertext data, the instruction receiver implements RSA decryption, and obtains the readable plaintext information of the specific transformation instruction, so as to prevent the data from being stolen and used during the communication process. And use the web3J interface to store it in the private chain. Since the data in the chain cannot be tampered with, these access record data can be used as digital evidence for the attacker to launch an attack, providing a legal system defense guarantee.

It can be seen from the above technical solutions that in the present invention, compared with the traditional collaborative mechanism under the centralized control of the central center, the blockchain technology is used to realize the decentralized operation of the array honeypot system, and each host realizes the automatic execution of the contract through the code on the chain. Without central control, the failure of any node cannot affect the normal operation of the system. At the same time, by adjusting the difficulty value, the transformation duration is in an optimal defense period, which can effectively resist attacks. In addition, the use of encryption technology ensures that sensitive data is prevented from being stolen during the communication process.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the present invention will be further described below in conjunction with the accompanying drawings and specific embodiments:

1 is a schematic diagram of an array honeypot collaborative control method based on a blockchain-based array honeypot collaborative control method disclosed by the invention;

FIG. 2 is a flowchart of a single instruction transformation method of the blockchain-based array honeypot collaborative control method disclosed by the invention.

Detailed ways

In order to make the purpose, technology and advantages of the present invention clearer, the present invention is described in further detail and completeness below with reference to the accompanying drawings.

Step (1): Under the Ethereum platform, use the genesis block file to build a private chain composed of n hosts in the honeypot inside the array, that is, priChain={host ₀ ,host ₂ ,...,host _n-1 }.

In the step (1), to build a private chain by using the creation file, it is necessary to perform data adjustment on the JSON type file, that is, modify the internal difficulty (difficulty value) parameter. By adjusting the difficulty value, the mining time interval T is within a reasonable range, so that the transformation period of the service hosts inside the array honeypot system is in the best defense stage.

Step (2): In n hosts, build a distributed dynamic array honeypot system with active defense function, namely honArray={sys ₀ ,sys ₂ ,...,sys _n-1 }.

In the step (2), in order to ensure the consistency of the honeypot system and the blockchain distribution structure, a P2P network architecture with equal status between nodes is established, and the architecture ensures the role equality of all hosts in the array, That is, each host acts as both a communication server and a communication client, and achieves peer-to-peer interoperability with the Ethereum platform.

Step (3): Deploy smart contracts on priChain that conform to the decentralized business logic of the array honeypot system.

The smart contract in the step (3) needs to meet the actual business requirements of the honeypot system and realize the automatic execution of the code on the chain.

Step (4): Create an Ethereum account account={ac ₀ ,ac ₂ ,...,ac _n-1 }, and perform mining.

The Ethereum account in the step (4) is created according to the corresponding node. Under the array honeypot system, one host mining node corresponding to one Ethereum mining account can meet the application needs.

Step (5): For the service host host _i corresponding to the successful mining account _{aci, the authenticity is verified by other n-1 hosts host j in} the private chain of the array honeypot, where j≠i.

Step (6): The honeypot host host _i , which has actually successfully mined, realizes the information transmission with the array honeypot system sys _i through the Ethereum platform interface.

In the step (6), in the honeypot system host that has successfully mined, sending transformation instructions to other hosts in the array, the RSA asymmetric encryption mechanism is used to ensure information privacy, and the instruction sender implements RSA encryption, and transmits the encrypted password. The instruction receiver implements RSA decryption to obtain the readable plaintext information of the specific transformation instruction, so as to prevent the data from being stolen and utilized during the communication process. The honeypot system host that successfully mines will also record the specific time, port and other information of service access, and use the web3J interface to store it in the private chain. Due to the immutability of the data in the chain, these access record data can be used as attackers. The digital forensics of the attack provides a legal system defense guarantee.

Step (7): The host _i of the array honeypot system that has received the successful mining instruction is responsible for the task of changing the specific information distribution of the service in the future T time period.

Step (8): After T period, a new round of mining operations is performed, and other hosts host _i with accounting rights different from host _i are selected, where j≠i, execute a cycle, and execute each of the array honeypots. The host service transforms the assignment task.

In the step (8), after the end of a single mining cycle, the next cycle is entered, and the selection of the accounting right host is continued, and a new host is selected to serve as the collaborative control task in the new cycle, and the specific changes are carried out. Generation and transmission of information.

The basic steps of the blockchain-based array honeypot collaborative control method are described in detail above. The array honeypot collaborative control method under this scheme builds the network architecture of the P2P array honeypot system, uses the Ethereum platform to perform mining operations, obtains the accounting rights host in the periodic interval, executes the generation of transformation information instructions, and the rest hosts Receive the instruction to perform actual service transformation, so as to realize the coordinated control of each honeypot service host in the array. Through the combination of the blockchain Ethereum platform and the honeypot system, it aims to ensure the normal operation of the service host cluster within the array honeypot system.

Claims (4)

1. An array honeypot cooperative control method based on a block chain is characterized by comprising the following steps:

(1) under an Ether shop platform, a creating block file is utilized to build a private chain formed by n hosts in honey pots in an array, namely, priChain ═ host₀,host₂,…,host_n-1In which host₀Denotes the 0 th host, host₂Indicating host 2_n-1Represents the n-1 st host computer;

(2) in n hosts, an array honeypot system with an active defense function is constructed, namely honArray { sys₀,sys₂,…,sys_n-1Wherein sys₀Represents a single honeypot system, sys, deployed by the 0 th host₂Represents a single honeypot system, sys, deployed by a 2 nd host_n-1Representing a single honeypot system deployed by the (n-1) th host;

(3) deploying an intelligent contract which accords with the decentralized business logic of the array honeypot system on the priChain;

(4) creating Etherhouse account ═ { ac₀,ac₂,…,ac_n-1Where ac is₀To representEther house account, ac, of host computer 0₂Etherhouse account, ac representing host 2_n-1Representing an Ether house account for the (n-1) th host, each host performing a mine excavation;

(5) account ac for mining success_iCorresponding service host_iBy the other n-1 hosts host in the private chain of the array honeypot_jVerifying authenticity of the product, wherein j is not equal to i;

(6) array honeypot system host receiving mining success instruction_iThe method is responsible for changing specific service information distribution tasks in the mining time interval T, and realizes the sys of the array honeypot system through the Ether workshop platform interface_iThe information transmission of (2);

(7) after a period of time T, a new round of mining is performed, selecting a host different from the host_iOther host with accounting right_jAnd j ≠ i, executing the loop steps from (5) to (7) and executing the service transformation distribution task of each host of the array honeypot.

2. The method as claimed in claim 1, wherein before building the private chain by using the founder file, a JSON type lightweight data exchange file containing block chain initialization information needs to be subjected to data adjustment, that is, an internal difficulty parameter is modified, and the mining interval T is within a reasonable range by adjusting the difficulty value, so that a transformation cycle of an internal service host of the array honeypot system is in a defense optimal stage.

3. The method as claimed in claim 1 or 2, wherein the method comprises establishing a peer-to-peer P2P network architecture between nodes when constructing the array honeypot system, the architecture ensuring the role equality of all hosts within the array, that is, each host acts as both a communication server and a communication client to realize topology peer-to-peer interworking with the ethernet platform.

4. The array honeypot cooperative control method based on the block chain as claimed in claim 3, comprising the steps of sending a transformation instruction to other array hosts in a honeypot system host which succeeds in mining, ensuring information confidentiality by using an RSA asymmetric encryption mechanism, implementing RSA encryption by an instruction sender, transmitting encrypted ciphertext data, implementing RSA decryption by an instruction receiver, obtaining readable plaintext information of a specific transformation instruction, recording specific service access time and port information by the honeypot system host which succeeds in mining, storing the information into a private chain by using a web3J interface, and taking the access record data as digital evidence of attack initiated by an attacker due to non-tamper-property of data in the chain.

Images