Network attack prevention phantom device establishment method, medium and device

Abstract

The invention provides a network attack prevention phantom device establishment method, a medium and a device. The method comprises the steps of obtaining features of true devices in a local area network; classifying the true devices according to the features, and taking each class of the true devices as device templates; setting configuration files of phantom devices according to the device templates; and loading the configuration files and generating the phantom devices. The similarity between the phantom devices generated by the method and the corresponding true devices is high, the phantomdevices can be perfectly camouflaged in the network, the high simulation camouflage can be realized, network attacks can be timely and effectively sensed, and the trapping, alarm and evidence obtaining can be carried out. The established phantom devices are simple in deployment and utilization, consumed computer resources and human resources are relatively few, and a security professional skill demand for deployment and maintenance personnel are low.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method, medium and equipment for establishing a phantom device for preventing network attacks. Background technique [0002] Existing active defense technologies such as honeynets and honeypots can effectively perceive and capture automated attacks such as botnets and scripts, but the camouflage technologies in the existing technologies cannot camouflage well, and are easy to be seen through by attackers, and traps are also easy Easily bypassed, less defensive. At the same time, the deployment and maintenance of active defense technologies such as traditional honeynets and honeypots have high requirements for personnel security expertise. Contents of the invention [0003] Aiming at the defects in the prior art, the present invention provides a method, medium and equipment for establishing a phantom device against network attacks. The phantom device established can ...

AI Technical Summary

Problems solved by technology

[0002] Existing active defense technologies such as honeynets and honeypots can effectively perceive and capture automated attacks such as botnets and scripts, but the camouflage technologies in the existing technologies cannot camouflage well, and are easy to be seen through by attackers, and traps are also easy Easily bypassed, poor defense

At the same time, the deployment and maintenance of active defense technologies such as traditional honeynets and honeypots have high requirements for personnel security expertise

Images