Vulnerability simulation overload honeypot method

Abstract

The present invention discloses a vulnerability simulation overload honeypot method which comprises a host computer, a port scanning deception simulating module, a vulnerability scanning deception simulating module, a vulnerability scanning deception simulating module, a vulnerability attach deception simulating module, a data auditing module and a vulnerability utilizing module. When the attach sequence arrives at the simulated honeypot, a simulated honeypot system is used for processing according to the situation. When an attacker executes vulnerability scanning to the virtual host computer, the simulated honeypot responds and processes according to the vulnerability configuration information. Afterwards, these vulnerabilities are used for further attacking. Hereon, the simulated honeypot system transmits the vulnerability attack data flow to a vulnerability honeypot system. The vulnerability utilization attach of the attacker is processed and responded by a vulnerability attack simulating module. Finally, when the attacker successfully obtains the control power through the vulnerability attack, the attack data hereon is transmitted to a physical honeypot module. All attack processes and related data are recorded by a data auditing module for analyzing comprehensively. The method reduces the number of hardware devices in the honeynet and reduces the cost.

Description

Technical field [0001] The invention relates to a method for overloading a honeypot with simulated loopholes, and belongs to the technical field of network information security. Background technique [0002] The application of honeypot and honeynet technology is to effectively obtain network intrusion information, understand the process and purpose of network intrusion for better protection. Honeynets can be divided into high-interaction honeynets and low-interaction honeynets according to their interaction capabilities. At present, the high-interaction honeynet mainly uses real hosts to form a network, and installs corresponding detection tools on the real hosts, which can obtain relatively complete intrusion information, but the resource requirements are too high. The low-interaction honeynet is mainly a virtual honeynet. A honeynet is virtualized by software on a host, and system information is configured for each virtual host. Its resource requirements are low, but it h...

AI Technical Summary

Problems solved by technology

[0009] To sum up, the main disadvantage of the existing vulnerability simulation technology in honeynets is the low interaction ability, and its simulated vulnerabilities can only deceive simple scanning and detection, and are easily seen by attackers

Moreover, the existing vulnerability simulation technology cannot provide attackers with the opportunity to exploit the vulnerability, and cannot capture further intrusion behaviors

At present, the high-interaction honeynet mainly uses real hosts to form a network, and installs corresponding detection tools on the real hosts, which can obtain relatively complete intrusion information, but the resource requirements are too high

Images