Mimic honeypot fingerprint obfuscation system and its sdn network architecture

Abstract

The invention belongs to the technical field of communication security, and particularly relates to a mimetic honeypot fingerprint obfuscation system, method and SDN network architecture thereof. The system includes: a control center deployed on a distributor for maintaining the working state of the honeypot, According to the suspicious traffic behavior characteristics fed back by the honeypot, the scheduling rules of the honeypot are dynamically generated, and the corresponding honeypots are started and closed according to the scheduling rules; the distributor, deployed between the honeypot group and the suspicious traffic source, is used to receive the suspicious output traffic, record the suspicious traffic, and broadcast to each honeypot in the honeypot group; receive the response message from the honeypot, and transmit the response message to the suspicious traffic source, which is used as a false response message to reply to the corresponding attacker, Among them, the honeypot group contains various types of honeypots. The invention utilizes a dynamic transformation mechanism to comprehensively schedule a plurality of honeypots, reduces the influence of a single honeypot system being controlled by an attacker on network security performance, and improves the reliability of the entire system.

Description

technical field [0001] The invention belongs to the technical field of communication security, in particular to a mimetic honeypot fingerprint obfuscation system and an SDN network architecture thereof. Background technique [0002] With the rapid development of network technology, network security threats are also emerging in an endless stream. Attackers can attack network weaknesses and loopholes to carry out activities such as information theft and system destruction, which seriously threatens network security. A honeypot system is a network resource that is deployed on the network and has the value of attracting and trapping. Its value can only be reflected when it is attacked or compromised. A honeypot is a deception technology aimed at protecting core network components. It only contains false sensitive data and cannot provide normal services to the outside world. Generally, a honeypot can be a network, a host, a service, useless data items in a database, a disguised ...

AI Technical Summary

Problems solved by technology

[0004] For this reason, the present invention provides a kind of mimetic honeypot fingerprint confusion system and its SDN network framework, solves the problem that the existing honeypot technology is difficult to resist fingerprint sniffing and isolated static defense deficiency, utilizes the dynamic transformation mechanism to carry out multiple honeypots Comprehensive scheduling reduces the impact of a single honeypot system being controlled by an attacker on network security performance, thereby greatly improving the reliability of the entire system

Images