Honey net safeguard system and honey net safeguard method for SDN (self-defending network)

Abstract

The invention discloses a honey net safeguard system for an SDN (self-defending network). The system comprises a network intrusion detection module, a honey net management module and an SDN controller cluster management module; the network intrusion detection module is used for performing intrusion detection on flow entering an organization; the honey net management module is the most important module of the system, and comprises a honey net design module, a honey net construction module, a flow rule conversion module, an encryption transmission module and a honey net model database; the SDN controller cluster management module is used for performing coordinated management and communication maintenance on a plurality of controllers in an organization intranet; furthermore, the invention also discloses a honey net safeguard method for the SDN. Through the honey net safeguard system and the honey net safeguard method, a honey net meeting the requirements can be automatically constructed according to each attack or each class of attacks or by artificially appointing the set of attack types, so a safety manager can be helped to better monitor suspicious attack conditions, and responds effectively.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a honeynet security protection system and method for an SDN network. Background technique [0002] Honeynet is a new concept gradually developed in honeypot technology, and it can also become a trapping network. Honeypot technology is essentially a research-type high-interaction honeypot technology. Its main purpose is to collect hacker attack information. But the difference with the traditional honeypot technology is that the honeynet constitutes a hacker trap network architecture, in which one or more honeypots can be included, while ensuring a high degree of controllability of the network and providing a variety of tools To facilitate the collection and analysis of attack information. [0003] Classification of honeynet technology: [0004] (1) Depending on the level of interaction [0005] Honeynets are classified according to the interaction between honeynets a...

AI Technical Summary

Problems solved by technology

[0009] The multi-level honeynet transmission method and system provided by this technology simply divide the threat level into three categories. Although it is improved compared with the traditional honeynet, it is still rough

In addition, each type of suspicious traffic is simply imported into the originally set honeynet. This mechanism is relatively rigid and inflexible; traffic of the same threat level is merged into a fixed honeynet, which is not conducive to the separate analysis of each attack.

In addition, when the scale of attack traffic suddenly increases and exceeds the expected setting, the honeynet resources are insufficient, making it difficult to normally play the role of honeynet protection and monitoring.

Images