Honeypot service port self-adaptive application method and system based on attack behavior analysis

Abstract

The invention relates to the technical field of network security, in particular to a honeypot service port self-adaptive application method and system based on attack behavior analysis. According to the invention, analysis is carried out based on attacker behavior data; an application service port of a honeypot system in a specific business area is automatically changed; the attack situation and the attack type of a certain specific service area can be self-adapted; the deployment efficiency of the application service port is improved, the attack type conforming to the service area is accurately captured, the trapping service port is efficiently transformed in real time in combination with the attack behavior characteristics and characteristics of an attacker, the system operation time consumption is greatly reduced, and the trapping rate and authenticity of the honeypot system are improved.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a honeypot service port self-adaptive application method and system based on attack behavior analysis. Background technique [0002] Honeypot technology generally pretends to be a vulnerable network service and business application, and opens an application service port to trap attackers to actively attack, monitor them, and record their attack behavior and data. [0003] Self-adaptation is the process of automatically adjusting processing methods and constraints according to data characteristics in the process of data processing and analysis, so as to adapt to the statistical distribution characteristics and structural characteristics of the processed data, so as to obtain the best processing effect. [0004] When the existing honeypot technology traps attackers, it will deploy a honeypot system in a specific business area, and open a service port related to the honeypo...

AI Technical Summary

Problems solved by technology

The present invention uses a low-interaction honeypot to cooperate with a high-interaction honeypot based on a vulnerability service or system, uses the low-interaction honeypot to quickly discover the existence of malicious samples, and uses a cloud deployment platform to quickly deploy a high-interaction service or system based on a vulnerability Honeypot, cooperates with high-interaction honeypot and low-interaction honeypot based on vulnerability services or systems to capture malicious samples, but when the invention is aimed at a large number of different types of business areas, it is necessary to set up high-interaction of multiple corresponding business areas Honeypot, when a large number of different types of attackers attack, the low-interaction honeypot must process a large amount of data and transfer traffic at the same time, which increases the running time of the system and increases the chance of being detected by the attacker. At the same time, the attacker's attack When the behavior changes, the high-interaction honeypot system cannot be changed in time, which further increases the chance of being detected

Images