A method, system, device and storage medium for discovering potential threats in a network

Abstract

This application discloses a method for discovering potential threats in the network. It directly installs the camouflage program on each terminal, and directly modifies some external parameters without affecting the normal use of each terminal, so as to lure malicious attackers into taking the bait. Due to the The disguised parameters are usually limited to common parameters such as IP, port, and service, and only create an illusion for the outside world, occupying negligible computing resources. At the same time, the upper-level centralized management platform is used to comprehensively plan the needs of each terminal in combination with the current security status of the entire network. How to camouflage to achieve a better camouflage effect as a whole. Since each camouflage program only needs to camouflage the parameters of the terminal where it is located, camouflage deployment and changes are more flexible, and the actual use effect is better. The present application also discloses a system, device and computer-readable storage medium for discovering potential threats in the network, which have the above-mentioned beneficial effects.

Description

technical field [0001] The present application relates to the field of honeypot (camouflage) technology, and in particular to a method, system, device and computer-readable storage medium for discovering potential threats in a network. Background technique [0002] With the advent of the information age, people can complete all kinds of work and tasks based on the network, which is not only efficient but also very convenient. Although the information stored in binary format is easier to save, it is also convenient. Therefore, in order to ensure the security of enterprise network, network security equipment came into being. [0003] Traditional network security devices are mainly composed of firewalls, IPS (Intrusion Prevention System, intrusion prevention system), these are only based on fixed threat detection rules or behavior patterns to identify potential network threats, after the attacker sees through the detection means, It is easy to use mutated malicious files or ot...

AI Technical Summary

Problems solved by technology

[0005] In the existing technology, the computing resources used to build honeypots or honeynets (consisting of multiple honeypots) need to be provided by additional hardware, and are usually arranged in front of the real network in a one-step manner, so that it is ahead of the real network Capture attack information, this method requires high deployment costs and change costs, because it requires cumbersome initial setup steps, it also makes it difficult to change the camouflage method and specific parameters, poor flexibility, and there is also integration with the real network Lack of tightness leads to the possibility of being seen through by the attacker

Images