Device and method for specifically and dynamically deploying and capturing malicious samples by using honeypot

Abstract

The application relates to a device and a method for specifically and dynamically deploying and capturing malicious samples by using a honeypot. The device comprises a virtual honeypot, a central control system and a cloud deployment platform. The method comprises the following steps: capturing attack activities and attack features by using the virtual honeypot; uploading the captured attack features to the central control system by the honeypot; analyzing the uploaded attack features by the central control system; starting a high interaction honeypot of vulnerabilities corresponding to the attack features by the cloud deployment platform; and importing virtual honeypot traffic into the started high interaction honeypot, wherein the corresponding high interaction honeypot is infected. According to the device and the method, a low interaction honeypot cooperates with the high interaction honeypot based on a vulnerability service or system; the malicious samples are detected rapidly by using the low interaction honeypot; the high interaction honeypot based on the vulnerability service or system is deployed rapidly by the cloud deployment platform; and the high interaction honeypot based on the vulnerability service or system cooperates with the low interaction honeypot to realize capturing of the malicious samples.

Description

technical field [0001] The invention belongs to the field of computer network security, and in particular relates to a device and a method for capturing malicious samples through targeted dynamic deployment of honeypots. Background technique [0002] Honeypots refer to computer devices that are carefully designed and deployed to attract intruders to collect information for research and analysis or to prolong the attacker's attack intent. Honeypots are divided into low-interaction honeypots, medium-interaction honeypots, and high-interaction honeypots according to their interaction capabilities. The main feature of the low-interaction honeypot is simulation. The deception technology is implemented by simulating the operating system and services. The attacker has only a small amount of interaction with the honeypot, so the attack information obtained is relatively small, which is more suitable for capturing automatic attack tools or For attacks launched by network worms, low-...

AI Technical Summary

Problems solved by technology

[0005] First, the existing malicious sample acquisition technology is difficult to simulate a large number of vulnerable services or systems; when multiple PCs spread malicious samples at the same time, there may be a large number of identical or different attack characteristics occurring at the same time, and the existing technology is very difficult. Difficult to capture all kinds of malicious samples attacked at the same time

[0006] Second, in the prior art, malicious samples exploiting vulnerabilities cannot be accurately forwarded to high-interaction honeypots containing corresponding vulnerable services or systems. It cannot be guaranteed to be correctly infected, making it difficult to capture malicious samples based on vulnerability attacks

[0007] Third, existing technologies cannot be dynamically deployed for the vulnerabilities used in attacks

[0008] Fourth, the capture of existing malicious samples requires a large amount of computing resources, and the cost of large-scale deployment of high-interaction honeypots is very high

Images