High-coverage intranet honeypot system

Abstract

The invention discloses a high-coverage intranet honeypot system. The honeypot system comprises an agent node comprising an attack drainage module; a first network card, a second network card and a proxy forwarding module, the attack drainage module is used for passing ARP spoofing; guiding a local area network access request of which a destination address is an idle IP address in a network segment where the local area network is located to the agent node, the IP address of the first network card and the IP address of the honeypot are in the same network segment; the first network card is usedfor communicating with a honeypot node; the IP address of the second network card and the IP address of the protected device in the local area network are in the same network segment. The second network card is used for communicating with equipment in the local area network, and the agent forwarding module is used for sending the local area network access request guided to the agent node to the honeypot node and sending attack response information returned by the honeypot node to an initiator IP address of the local area network access request. Through the technical scheme provided by the invention, the IP address coverage rate of the honeypot in the honeypot system is improved while the IP address occupation of the honeypot is reduced.

Description

technical field [0001] This application relates to the technical field of network security, in particular, to a high-coverage intranet honeypot system. Background technique [0002] In order to deal with attacks from the Internet, traditional network defense technologies set up firewalls, intrusion detection systems and other devices at the network border to prevent attacks from reaching the intranet. However, attackers can still infect and control a certain host in the intranet through means such as phishing emails, and then launch other attacks on the intranet. [0003] A honeypot is a false resource that can induce attackers to attack it, and record and analyze the attack behavior. Deploying honeypots on the internal network can effectively make up for the defects of border defense equipment, send early warning information to security personnel in a timely manner, and guide reinforcement measures. In order to protect the security of the intranet to the greatest extent, ...

AI Technical Summary

Problems solved by technology

However, this method will occupy a large number of IP addresses for a long time and affect the allocation of IP addresses in the business system

Images