Method of forwarding attack traffic to honeypot

Abstract

The invention discloses a method for forwarding attack traffic to a honeypot. A gateway agent mode is adopted; a gateway and a flow forwarding module are simply deployed; request access to a sensitiveport on a real service server is forwarded to a gateway; the gateway carries out flow forwarding module rule configuration, forwards the request of the attacker to the honeypot, the honeypot carriesout attack evidence obtaining and replies the access request of the attacker, forwarding of the data packet is easily achieved through the gateway, and the situation that the whole communication quality is affected by instability generated in the agent disguising process is prevented. Intrusion detection is carried out, deployment is easy and convenient, operability is high, network safety and enterprise service safety and stability are maintained, and convenience is provided for disguise agency deployment of small and medium-sized enterprises.

Description

technical field [0001] The invention relates to computer information security, in particular to a method for forwarding attack traffic to a honeypot. Background technique [0002] Honeypot technology is essentially a technology to deceive the attacker. By arranging some hosts, network services or information as bait, the attacker is induced to attack them, so that the attack behavior can be captured and analyzed, and the attack behavior can be understood. The tools and methods used by the party, and the attack intention and motivation can be speculated, so that the defense party can clearly understand the security threats they face, and enhance the security protection capabilities of the actual system through technical and management means. [0003] The existing masquerade proxy technology cannot realize the interaction between the attacker and the honeypot through the simple rule configuration of the traffic forwarding module, but needs to be managed by deploying the honeyp...

AI Technical Summary

Problems solved by technology

[0003] The existing masquerade proxy technology cannot realize the interaction between the attacker and the honeypot through the simple rule configuration of the traffic forwarding module, but needs to be managed by deploying the honeypot agent terminal and the honeypot management terminal, which makes the cost of masquerading proxy high, and the existing Masquerade proxy technology, the deployment cost is relatively large, and the data transmission process is relatively complicated

Images