Honey pot mechanism and method used for collecting and intercepting internal storage behaviors of computer

Abstract

The invention discloses a honey pot mechanism and method used for collecting and intercepting internal storage behaviors of a computer. The mechanism comprises an internal storage virtualization module, a honey pot module, an introspection module, a control module and a honey pot recording module; the mechanism is based on the internal storage virtualization technology, supports the SMP structure, can deploy a lightweight virtual machine when an operating system operates, and monitors the internal storage behaviors in a honey pot; the mechanism can also serve as a submodule of other virtual machines to achieve the same functions; the honey pot monitors the accurate amendment situations of each course of multiple kernels on the key area of an internal storage when the operating system operates, the amendment situations are represented by a bitmap, at the same time, the introspection module collects related detailed course information and the state when the course completely operates at that time, and all records are centralized in the honey pot recording module. On the basis of the event-driven mode, any codes of the operating system of an object are not amended, and compared with existing instruction-level monitoring, the performance losses are low, the flexibility is high, and the method is applicable to real-time evidence obtaining and dynamic analysis.

Description

technical field [0001] The invention relates to a mechanism in the field of computer behavior monitoring, in particular to a honeypot mechanism and method for collecting and intercepting computer memory behavior. Background technique [0002] Honeypot technology is divided into high-interaction honeypots and low-interaction honeypots according to the degree of interaction. Low-interaction honeypots deploy honeypots by simulating operating systems and network services. Although the deployment is simple, due to the limited degree of simulation, the information obtained is insufficient and easy Be seen through. The high-interaction honeypot provides a completely real operating system and network services, and can obtain very rich attack information, but the potential risks and the difficulty of deployment are very high. At present, high-interaction honeypots can be implemented through virtualization technology to observe the state changes in the honeypot. This involves the dy...

AI Technical Summary

Problems solved by technology

[0005] Aiming at the deficiencies of the prior art in the field of computer monitoring, the present invention provides a honeypot mechanism and method for collecting and intercepting computer memory behaviors, adopting the basic idea of ​​honeypots to deploy honeypots in critical memory areas, and monitor all modified The process of the memory in the honeypot uses the method of non-instruction level monitoring, which solves the limitations of the current analysis of memory behavior based on the instruction level

Images