Honey pot active defense method and honey pot active defense system based on Serverless framework

Abstract

The invention discloses a honey pot active defense method and a honey pot active defense system based on a Serverless framework. The honey pot active defense method comprises the steps: identifying anattack behavior type according to attack information of an attacker and generating a corresponding dispatching instruction according to an identifying result; choosing a container mirror image of anattach processing function corresponding to the attach behavior type from a mirror image warehouse according to the dispatching instruction, performing instantiation to establish a container which canoperate the attack processing function and utilizing the container to process of the attach information to generate response information; receiving the response information and sending the response information to the attacker. By means of the honey pot active defense method disclosed by the technical scheme of the invention, different types of attacks can be quickly responded; in addition, a honey pot is achieved by the container, a better environmental isolation effect is achieved, and that the attacker threatens the whole network environment through the honey pot environment is prevented tothe maximum extent.

Description

technical field [0001] The invention relates to the field of network technology, in particular to a serverless architecture-based honeypot active defense method and a honeypot active defense system. Background technique [0002] With the development of the Internet, network security has received extensive attention. The current network security technology is mainly divided into passive defense technology and active defense technology. [0003] Among them, the passive defense technology prevents hackers from externally and controls access internally. It mainly configures security policies through firewalls and other devices, and strives to formulate defense policies before attacks occur, thereby blocking them. [0004] Active defense technologies mainly include technologies such as intrusion detection and honeypots, and strive to sense attacks when they occur, so as to deploy defenses. Among them, the honeypot technology deploys one or more vulnerable hosts in the production...

AI Technical Summary

Problems solved by technology

[0005] However, the existing honeypot systems are all deployed in real system environments and networks with limited resources. For the current increasing number of resource-exhausting denial of service (Denial Of Service, DOS) attacks, it is impossible to Quick response

In addition, the existing honeypot system can cope with a single type of attack and is extremely easy to be compromised; at the same time, since the honeypot system is deployed in a real system environment, once it is discovered and compromised by an attacker, it can be used as a springboard to The entire network environment where the threat resides

Images