High-interaction honeypot based network security system and implementation method thereof

Abstract

The invention discloses a high-interaction honeypot based network security system and an implementation method thereof. The system comprises a honeypot monitoring module, a website correlation analysis module, a summarizing analysis / display module, wherein the honeypot monitoring module is used for carrying out classified acquisition on the attack incidents network behavior logs and host behavior logs; the website correlation analysis module is used for carrying out summarization and automatic correlation analysis on the attack incidents network behavior logs and the host behavior logs, and filtering invalid network alarms, capturing known attack incidents, automatically finding out unknown attack incidents, and extracting concealed Internet malicious resource information according to the automatic correlation analysis results; and the summarizing analysis / display module is used for summarizing and accounting known attack incidents and / or unknown attack incidents captured on all honeypot websites, displaying and reducing selected attack incidents for users, and carrying out automatic detection on concealed Internet malicious resources according to the concealed Internet malicious resource information.

Description

technical field [0001] The invention relates to the field of computer technology, in particular to a high-interaction honeypot-based network security system and an implementation method. Background technique [0002] In the prior art, the honeypot technology is a network trapping technology, which is widely used in the field of network security, especially the capture of malicious codes and the tracking and analysis of network attack events. [0003] From the degree of interaction of honeypot data, honeypot technology can be divided into two categories: low-interaction honeypot and high-interaction honeypot. Low-interaction honeypots use simulation technology, there is no real operating system and services, and the degree of interaction is low, and they can only simulate the response behavior of operating systems and applications based on known vulnerabilities; high-interaction honeypots run on real operating systems, deploy Real applications can construct a real service en...

AI Technical Summary

Problems solved by technology

[0004] At present, high-interaction honeypot solutions generally run in a virtual machine environment. Through certain system monitoring methods, specific types of attack logs on honeypots are collected. This single log acquisition method cannot form the ability to analyze attack events at all. It is impossible to detect unknown events

[0005] Specifically, in the prior art, the main shortcomings of the honeypot application are as follows: 1. The victim host is simulated based on the low-interaction honeypot, so only attack logs for known vulnerabilities can be captured

2. Even if a high-interaction honeypot is used, the attack log capture and correlation analysis capabilities are insufficient, and the automatic correlation and restoration of attack scenarios cannot be realized, and it is difficult to find unknown attacks from numerous event logs

3. Only passively capture the traces left by the attacker on the honeypot, and cannot actively analyze and extract malicious resources controlled by the attacker and distributed on the Internet

Images