Honeynet protection method and system

Abstract

The invention relates to the field of network security, and especially relates to a Honeynet protection method and system. The method includes the following steps: detecting whether the data traffic entering a business system is abnormal; after detecting abnormal data traffic, creating a virtual Honeynet system according to a business system corresponding to a destination address accessed by the abnormal data traffic; and carrying out network configuration on the virtual Honeynet system according to the network configuration of the business system, and scheduling the abnormal data flow to the virtual Honeynet system. The virtual Honeynet system consistent with the business service of the business system is created, and network configuration is carried out on the virtual Honeynet system. The consistency between the virtual Honeynet system and the business system in business logic and network configuration is ensured, the virtual Honeynet system is more concealed, and attack seduction and forensic analysis are more concealed and less detectable to attackers. Moreover, the deployment is relatively simple, and the method and the system can be quickly deployed to an SDN (Software Defined Network) to achieve security protection without increasing the overhead of the business network.

Description

technical field [0001] The invention relates to the field of network security, in particular to a honeynet protection method and system. Background technique [0002] Honeynet is a new type of trapping network system gradually developed on the basis of honeypots, and it is an active defense method proposed by the offensive and defensive players in a passive environment. With the continuous development of virtualization technology, more and more people pay attention to the dynamic virtual honeynet. The virtual honeynet can dynamically plan and build the honeynet according to the attacker's access behavior, and can attack and deceive more quickly. And analyze the attack behavior. [0003] The realization of a dynamic virtual honeynet is inseparable from the accurate simulation of the business network and the flexible scheduling of traffic. With the continuous maturity of software-defined networking (Software Defined Networking, SDN) technology, its logically separated contro...

AI Technical Summary

Problems solved by technology

[0005] However, in the existing technology, when the honeynet system is constructed, only the simulation of the business system is considered, that is, the honeynet system can provide the response and interaction of the business logic like the real business system, but the network adopts a method different from that of the business system. For advanced intrusion threats, the honeynet system is easy to be discovered by attackers, and the honeynet concealment protection and evidence collection cannot be achieved.

Images