Defense honeypot-based security threat active sensing method

Abstract

The invention discloses a defense honeypot-based security threat active sensing method. Based on understanding of a Hook technology, whether a defense honeypot intercepts and captures a test functionor not is judged by analyzing an execution Trace of a system function; firstly the to-be-detected system function is injected into an untrusted process and is executed to obtain an instruction execution record (Trace) of the function; further according to a characteristic that the defense honeypot intercepts and captures the Trace of the system function, an address space finite state automata is designed, and the obtained Trace is analyzed in the automata to judge the system function intercepted and captured by the defense honeypot; and finally, a test function set is traversed to identify threat sensation of the target defense honeypot. The threat sensation of the target defense honeypot can be identified; and compared with an existing threat sensation identification method, the method has the same defense honeypot-based threat sensation identification capability, and is more automatic and more efficient.

Description

technical field [0001] The invention relates to a security threat active sensing method, in particular to a security threat active sensing method based on defense honeypot. Background technique [0002] With the rapid development of computer technology, active defense technology has gradually replaced passive defense technology and has become the main research direction of computer security today. Although the application of firewall and intrusion detection technology is still very common, facing the increasing diversification of attack methods and the continuous improvement of network security requirements, the detection of intrusions that have occurred (passive detection) can no longer meet the requirements of computer security. More emphasis is on active defense and early defense. [0003] Therefore, active defense technology will attract more and more people's attention. Active defense technology tries to contain and divert attack behavior, conduct technical analysis an...

AI Technical Summary

Problems solved by technology

Although the application of firewall and intrusion detection technology is still very common, facing the increasing diversification of attack methods and the continuous improvement of network security requirements, the detection of intrusions that have occurred (passive detection) can no longer meet the requirements of computer security. More emphasis is on active defense and early defense

Images