A defense method based on a large number of deployed decoy hosts to detect and intercept intranet attack sources

Abstract

The invention discloses a defense method based on a large number of deployed decoy hosts to detect and intercept intranet attack sources, comprising the following steps: step 1: designing switching equipment and building a network bridge br0; step 2: connecting a computer or an industrial control computer to the network through a network cable Switch the device; Step 3: In the internal network, the switching device performs ARP Ping survival detection; Step 4: The switching device virtualizes the decoy host; Step 5: The hacker enters the internal network to infiltrate the internal network, the hacker detects the decoy host, and conducts Attack; Step 6: Resist hackers or ransomware attacks. The present invention can be combined with CPU-based switching equipment, deployed in all TCP / IP-based intranet systems, and has broad application prospects.

Description

technical field [0001] The invention relates to the field of computer network intranet protection, in particular to a defense method for detecting and intercepting intranet attack sources based on the deployment of a large number of decoy hosts. Background technique [0002] "North-south" traffic refers to traffic flowing from the external network to the internal network. Generally, firewalls are deployed at the egress of the network for security protection of "north-south" traffic. "East-west" traffic refers to the internal traffic generated by mutual access between servers in the network. According to statistics, more than 75% of the traffic in the current data center is "east-west" traffic. Whether it's stealing private information or damaging someone's reputation, taking down critical government infrastructure or putting businesses at risk, today's cybercriminals are constantly testing the boundaries of the security and resilience of their networks. [0003] Despite the...

AI Technical Summary

Problems solved by technology

[0018] In order to overcome the deficiencies in the existing technology, a defense method based on the deployment of a large number of decoy hosts to detect and intercept intranet attack sources is provided. It is an attack discovery and security protection technology that prevents the outbreak of ransomware and prevents hackers from penetrating. It solves the problem Difficult to find and intercept network attacks in the intranet

Images