Implementation method and device of application-type honeypot

Abstract

The invention provides an implementation method and device of an application-type honeypot. The implementation method comprises the following steps: obtaining application service to be simulated and the attribute information and the application environment of the application service to be simulated, and deploying the same application service and application environment into the honeypot; setting the corresponding attributes of the honeypot, for example, a login account of the application service of the honeypot is set to be the same with the application service to be simulated, and the known controllable security holes of at least one application service is opened; according to a user flag, carrying out decryption processing on all pieces of business data in the application service, applying a confounding algorithm to carry out deformation processing on all pieces of business data, and then, importing the business data into the application service of the honeypot; and importing newly-added business data into the application service of the honeypot in fixed time or real time. The invention also provides corresponding equipment. The application-type honeypot can be combined with the real business data of the user to confuse an attacker to a maximum degree, and the attacker is enabled to think that the honeypot is the real application service data of the user.

Description

technical field [0001] The invention relates to the field of computer security, in particular to a method and device for realizing an application-type honeypot. Background technique [0002] Honeypot technology is a kind of host and service that pretends to be useful and has BUG or flaws to attract attackers or malicious codes to invade, so as to analyze the behavior motives and technical details of the attackers or malicious codes for research and defense etc. [0003] At present, honeypot technology in the network security industry is generally divided into two types: low-interaction honeypot and high-interaction honeypot. Low-interaction honeypots generally use low-level simulation technology to achieve very elementary interactions, and the captured network behavior is also very limited. Typical representatives For HoneyD, Nepenthes, Dionaea; high-interaction honeypots generally use full-featured services or modified disguised services, and install agents or traffic anal...

AI Technical Summary

Problems solved by technology

[0005] Based on the above problems, the present invention provides a method and device for implementing an application-type honeypot. By using processed real application services and real data, the service and data in the existing honeypot technology are too simple to be perceived as Honeypot problems, while ensuring the activity of data in the honeypot, to achieve the purpose of attracting attackers or malicious code to run in the honeypot

Images