A honeypot host

Abstract

The present invention relates to a honeypot host (500) adapted in a network (90). The honeypot host (500) of the present invention is generally comprised of a computer system (10) and a honeypot system (300) incorporated in the computer system (10). The honeypot system (300) generally deploys at least one decoy host 80 to at least one unused Internet Protocol (IP) address (160) around the network (90). The honeypot system (300) is further adapted to be self-replicable. In the event that a honeypot system (300) in the network (90) is compromised, the honeypot system (300) is capable of self-terminating at least a portion of the compromised honeypot system (300) and self-replicating a new honeypot system (300). The honeypot system (300) is also further adapted to detect whether the current honeypot system (300) has been compromised.; The present invention is also related in another aspect to a method for replicating a honeypot system (300) to replace a compromised honeypot system (300).

Description

technical field [0001] The invention relates to a honeypot host for network. Background technique [0002] For common computer technologies, honeypot systems have been developed for network security. The honeypot system is basically the most secure defense mechanism in the network to detect and prevent network attacks. [0003] There are also honeypot systems that facilitate the generation of decoy hosts around unused Internet Protocol (IP) addresses. Decoy hosts pretend to be real computers in the network, but in reality, decoy hosts are counterfeit schemes, and they tend to replace other operating hosts to attract attackers to invade these decoy hosts. These honeypot systems imitating decoy hosts are installed in computer hardware, which runs on the operating system. [0004] figure 1 The traditional honeypot host mentioned above is shown in . Such as figure 1 As shown, the honeypot host has certain restrictions, that is, it can only run on a single machine configura...

AI Technical Summary

Problems solved by technology

[0005] There is also the inconvenience that in the event a honeypot host is compromised, the honeypot administrator needs to remove the host off the network, then make a copy of its hard drive and reinstall everything in a new setup , so that the honeypot host can again use the

Time will be unnecessarily wasted setting up the same honeypot system repeatedly every time the honeypot host is compromised

Also, while the honeypot host is doing the installation, other attacks can happen silently inside the local network

Therefore, when the honeypot host is invaded, if the network administrator misses some unknown attacks, it will cause disadvantages

Images