System-level honeypot network isolation system based on linux network filter

Abstract

The invention provides a system-level honeypot network isolation system based on a linux network filter, and relates to the technical field of network security, and the corresponding method comprisesthe steps: determining outgoing flow which comprises a target IP; judging whether the target IP is in the honeypot IP set or not; if not, judging whether the target IP is in the service IP set or not;and if not, discarding the outgoing flow. The technical problem that for an existing honeypot, the risk that a service system is invaded exists, and normal service safety is threatened is solved.

Description

technical field [0001] The present application relates to the technical field of network security, in particular to a system-level honeypot network isolation system based on a linux network filter. Background technique [0002] Honeypot technology is a network security technology developed based on the concept of deception defense. It differs from traditional network security technologies in that traditional network security devices are usually access switches, and firewalls monitor network traffic upstream. The honeypot network security is generally positioned at the security protection of the user's business network. [0003] Honeypots are usually deployed on the same network as servers in the business environment. This requires that the honeypot network cannot be breached. Once an attacker escapes from the honeypot network to the business environment, it will cause immeasurable losses. [0004] However, for the current honeynet engine, it is very easy for an attacker t...

AI Technical Summary

Problems solved by technology

[0005] The purpose of the present invention is to provide a system-level honeypot network isolation system based on a linux network filter, to solve the technical problem that the existing honeypot has the risk of business system being invaded and threatens the normal business security

Images