Network trapping method based on honey pot

Abstract

The invention discloses a honeypot-based network trapping method, which comprises an outer firewall, an inner firewall and a network deception system. The beneficial effects of the invention are: the "wide entry" of the internal firewall is to confuse the intruder and let him "make the best use of it", while the "strict exit" ensures that the intruder's activities are limited to the "cage", and more data can be collected , evidence, and also prevent intruders from using the system as a springboard to conduct further attacks on other systems. Organizing information to deceive forged persons and locations also requires forged information such as salary, budget, and personal records. The more real the forged information is , the more you can avoid deception, and it is easy to be discovered. Network traffic simulation replicates all access connections, making the deception system very similar to the real system. Service camouflage writes a series of scripts in the system to simulate the characteristics of some application services, providing seemingly Normal service, leading the attacker to believe that the trapping system is a functioning system.

Description

technical field [0001] The invention relates to a network trapping method, in particular to a honeypot-based network trapping method, belonging to the technical field of network security. Background technique [0002] A honeypot is a security resource whose value lies in being detected, attacked or compromised. Honeypot technology is a decoy technology that lures intruders through false resources to collect hacker attack data and analyze hacker attack behaviors to achieve the goal of protecting real hosts. This means that the honeypot is a pre-configured system, which may contain certain loopholes, or contain various forged documents and information to deceive hackers into attacking and invading the honeypot. [0003] The significance of the existence of the honeypot system is to be detected and attacked. Any interaction with the honeypot can be considered as an attack. Therefore, through the monitoring of the honeypot, the behavior of the attacker can be discovered, analyz...

AI Technical Summary

Problems solved by technology

[0004] Traditional information security technology mainly focuses on blocking and detection for attack prevention, such as firewall and IDS, but these two technologies have their limitations. The firewall controls access based on fixed policies, and the Behavior cannot provide protection, and IDS can only respond after the attack starts or completes, and at the same time, a large number of false alarms will be generated, which will bring greater trouble to users

Images