Method and an apparatus for realizing network traceless honeypot

Abstract

The invention provides a method and apparatus for realizing a network traceless honeypot. The method comprises the following steps: a honeypot environment is set up by use of a virtualization technology, through a control mode provided by the virtualization technology, a honeypot external control module actively initiates data transmission with a honeypot internal monitoring module, such a mode does not generate network flows in the honeypot environment, and the network location of a honeypot external control program cannot be obtained at all in a honeypot. The invention also brings forward a corresponding apparatus. Through the network traceless honeypot, network behavior of uploading data in the honeypot can be hidden completely, an attacker is quite confused, and thus the purpose of more effectively luring the attacker is realized.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a method and device for realizing a network traceless honeypot. Background technique [0002] Honeypot technology generally pretends to be a network service with loopholes. Its value lies in being compromised or exploited, and can respond to attacks. It can be used to deceive attackers, attract attackers or malicious codes to invade, increase its attack cost, and Monitor, record and analyze attack behaviors, predict attack intentions, and achieve targeted defense. [0003] Honeypots are generally divided into low-interaction honeypots and high-interaction honeypots. Low-interaction honeypots generally use simulated services, which can only perform primary interactions, and the data that can be recorded and analyzed is limited. High-interaction honeypots can generally provide close to The real environment can record in-depth and diversified attack data, so as to carr...

AI Technical Summary

Problems solved by technology

[0005] Based on the above problems, the present invention provides a method and device for implementing a network traceless honeypot, which transmits data with the outside of the honeypot in a way that does not generate network traffic in the honeypot, and solves the problem of the existing honeypot technology passing through the network. Data transmission is easily perceived as a honeypot problem, while ensuring the concealment of the monitoring module in the honeypot, which can prevent the attacker from finding himself in the honeypot by monitoring network traffic

Images