Method and system for updating and restoring honeypot database

Abstract

The invention discloses a method and system for updating and restoring a honeypot database. Firstly, real business data is processed and filled into the honeypot database, and the honeypot database is set as low authority; elements in the honeypot database are copied The data and the processed real business data form a backup database, and the backup database is set as a high authority; the honeypot database is opened to the outside world; the incremental data of the real business data is processed and updated to the honeypot database and the backup database at the same time; If a restoration request is received, the original honeypot database is deleted, and the backup database is copied to form a new honeypot database. The technical scheme of the invention not only solves the problem that data changes caused by the intrusion of the honeypot database and thus affects subsequent use, but also can complete the import of incremental data during the intrusion process of the attacker, making the honeypot database more authentic and credible.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a method and system for updating and restoring a honeypot database. Background technique [0002] With the current evolution of honeypot technology, due to the lack of rich data, hackers can tell whether the target is a honeypot after only a preliminary intrusion and give up subsequent attacks. At this time, even if the source of the attack is captured and the person is located, but Due to the small number of operations, you can evade company regulations and legal sanctions for reasons such as "unintentional viewing", "input errors", and "safety inspections". [0003] In the evolution of database-oriented application-level honeypot technology, especially for the simulation implementation of business systems, a large amount of data is also added to it, which helps to analyze the attacker's intrusion process and purpose in more detail, and the attacker will have no rea...

AI Technical Summary

Problems solved by technology

The disadvantage is that the switching time is long, the data import and export speed is slow, and the opportunity of being invaded may be missed

[0007] The biggest problem with the above existing technologies is that the attacker is likely to observe whether there is incremental data imported during the intrusion process, and will also modify the database content at the same time, but the above two solutions do not affect the security of the snapshot content. , cannot complete the supplement of incremental data in the process of being attacked, which will affect the authenticity of the honeypot database

Images