Method for realizing attack processing, honeypot deployment method, medium and equipment

Abstract

The invention discloses a method and device for realizing attack processing and a honeypot deployment method, and the method at least comprises the steps: pulling a stored honeypot mirror image from ahoneypot mirror image cloud warehouse, wherein the honeypot mirror image is a honeypot structure supporting a multi-CPU architecture; creating a container on the cloud host, wherein the container correspondingly supports honeypots of different CPU architectures; capturing attack data through honeypots supporting different CPU architectures. According to the application, the capture range of honeypots is expanded based on a cloud deployment mode, an elastic and dynamic honeypot cluster management mode is realized, and the value of honeypot data is mined more deeply by combining big data analysis service on the cloud; moreover, based on the characteristics of the container, the honeypot deployment and maintenance cost is reduced, and the time is saved.

Description

technical field [0001] This application relates to but not limited to network attack defense technology, especially a method for realizing attack processing based on the Internet of Things (IoT, Internet of Things), a honeypot deployment method, media and equipment. Background technique [0002] In the offensive and defensive confrontation in cyberspace, honeypot technology is used as an intrusion bait to lure hackers to attack. After the attacker invades, through monitoring and analysis, on the one hand, it can be used to investigate the source of the attacker and the latest attacks and vulnerabilities launched against the server, and on the other hand, to examine whether the security measures used for protection are effective. Among them, a honeypot is a security resource whose value lies in being scanned, attacked, and compromised, that is, the honeypot has no other practical function, and all network traffic flowing into / out of the honeypot may indicate scanning, attacki...

AI Technical Summary

Problems solved by technology

With the development of IoT, network attacks against IoT devices are becoming more and more serious, and IoT devices use a wide range of architecture types, such as Advanced Reduced Instruction Set Machine (ARM, Advanced RISC Machine) architecture, Enhanced RISC Performance Optimization (PowerPC, Performance Optimized With Enhanced RISC) architecture, etc., the honeypot technology provided in related technologies, on the one hand, cannot capture attacks against these types of networks; on the other hand, limited by the physical resources and IP resources of honeypot users, honeypot The deployment range of honeypots is limited, so the attack behaviors captured are also limited; moreover, when a large number of honeypots need to be deployed on the Internet, the deployment and maintenance costs of traditional honeypots are relatively high.

Images