A method and system for deception prevention based on dynamic network constructed by SDN

Abstract

A method for deception prevention based on dynamic network constructed by SDN comprises steps as follows, firstly, the attacker is identified and recorded, and the SDN interface is called according tothe related information of the attacker, and the traffic data from the IP of the attacker server to the IP of the attacker server and the corresponding port are forwarded to the same port of the honeypot. If the honeypot captures the traffic data of an attacker, the attacker server IP address is defined as a high-risk IP address and the high-risk IP address is blocked. The invention combines thedistribution and scheduling of the honeypot network with the SDN technology, dynamically adjusts the flow direction of the attacker according to the behavior of the attacker, and dynamically changes the static network. Honeypot network intercepts and blocks the high-risk IP address, so that attackers can no longer get the real information of the target port, service or system, so as to actively induce attackers to attack the honeypot, capture the attacker's behavior, isolate the attack.

Description

technical field [0001] The invention relates to the technical field of defending against network attacks, in particular to a method and system for defending against deception based on SDN to construct a dynamic network. Background technique [0002] The concept of honeypots was proposed in the 1990s. At first, security researchers such as Fred Cohen and Niels Provos used low-interaction honeypots to deceive attackers. Because they were easy to be detected, most security researchers used real systems to build honeypots. Network, honeypot technology has developed to the present, the independent honeypot network has been relatively mature, but there are still some obvious defects, such as the dense network system is still independent and static, it is difficult to carry out active defense, and can only passively wait for attackers to enter Honeypot network, and then capture the attack behavior. Traditional IPS products have a large number of false positives. When an attack is ...

AI Technical Summary

Problems solved by technology

[0002] The concept of honeypots was proposed in the 1990s. At first, security researchers such as Fred Cohen and Niels Provos used low-interaction honeypots to deceive attackers. Because they were easy to be detected, most security researchers used real systems to build honeypots. Network, honeypot technology has developed to the present, the independent honeypot network has been relatively mature, but there are still some obvious defects, such as the dense network system is still independent and static, it is difficult to carry out active defense, and can only passively wait for attackers to enter Honeypot network, and then capture attack behavior

There are a large number of false positives in traditional IPS products. When an attack is discovered, the only choice is to block the attack to stop the loss. It is impossible to obtain more attacker information and give the attacker more deterrence.

Moreover, with the prevalence of cloud computing today, there are few security technologies that combine honeypot network technology with cloud computing. Some honeypot networks on the cloud are only independent and static, waiting for attackers to attack, and cannot be dynamically constructed. induce

Images