Attack intelligent trapping system and method based on virtualization

Abstract

According to the virtualization-based attack intelligent trapping system provided by the invention, intelligent trapping of attackers is realized by constructing two stages of honeypots in the SDN. The first level is a reconnaissance honeypot and provides real services, and when an attacker scans the system and attacks the attacker, the reconnaissance honeypot and the attacker perform preliminaryinteraction to obtain attack data. Analyzing is carried out on the preliminary attack data to identify an attack target of an attacker and predict an attack intention of the attacker; and a corresponding second-stage honeypot is started, namely a special honeypot by combining a scene knowledge base, attack flows are migrated into the special honeypot, an attacker is enabled to perform deep interaction with the special honeypot, and the state of the special honeypot is stored for subsequent analysis after the attack is finished.

Description

technical field [0001] The invention belongs to the technical field of Internet security, relates to a honeypot system, and in particular to a virtualization-based attack intelligent deception system and method. Background technique [0002] The existing technology that can well deceive attackers is the honeypot technology. By arranging some decoy hosts, network services or information, the attackers can be lured to attack them, so that the attack behavior can be captured and analyzed to understand The tools and methods used by the attackers, as well as the inference of attack intentions and motivations, can enable the defenders to clearly understand the security threats they face, and enhance the security protection capabilities of the actual system through technical and management means. The honeypot can also be regarded as an intelligence collection system, which deliberately exposes the target of the attack and lures the hacker to attack. After the attacker invades, we c...

AI Technical Summary

Problems solved by technology

[0003] However, the traditional honeypot system is mainly deployed in hardware servers. On the one hand, it is difficult to dynamically adjust the honeypot structure according to the attack behavior, that is, it is impossible to dynamically change the deception scene to achieve the effect of intelligent deception. On the other hand, a large number of physical The infrastructure is used for the deployment and operation of the honeypot system, and the cost of security protection is relatively high

Images