A method and system for improving the accuracy of alarm output of a honeypot system

Abstract

A method and system for improving the accuracy of alarm output of a honeypot system belong to the field of network technology and security technology. The method includes: extracting a first security alarm event recorded in a security event log, and adding the first security alarm event according to the security event log. Feature tags, extract the second security alarm event in the attack log data, match the first security alarm event with the second security alarm event, add detailed business description and comprehensive basic information, and output as a honeypot system alarm; the system includes : a first extraction module, a marking module, a second extraction module, a matching module, a collection module, and an output module; the beneficial effects are: breaking the information islands between various network security devices, realizing information linkage, and improving the accuracy of the honeypot system alarm output , to avoid unnecessary waste of human resources in the response and disposal of network security incidents, and improve the ability to quickly handle security incidents.

Description

technical field [0001] The invention relates to the field of network technology and security technology, and in particular, to a method and system for improving the accuracy of alarm output of a honeypot system. Background technique [0002] Honeypot systems are systems that are purposefully deployed for detection, attack, and misappropriation by malware in order to discover, identify, and characterize such software; with the development of Internet technology, network scanning, worm and virus codes are Propagation and malicious attacks by hackers make every host on the network at risk at any time, and the honeypot and honeypot system are proposed to take the initiative to study this security threat. These attacks are monitored, detected, and analyzed. [0003] There are many types of honeypot technologies in the prior art, but in general most of them are implemented by passive interception and temptation attacks. Due to the poor ability to detect security events in the clo...

AI Technical Summary

Problems solved by technology

[0003] There are many types of honeypot technologies in the prior art, but generally most of them are implemented by means of passive listening and temptation attacks. Due to the poor ability to discover security events in the cloud resource system environment and the high false alarm rate of commonly used security devices, honeypots The system also outputs a large number of irrelevant business behaviors and normal business behaviors as alarms. The honeypot system based on characteristics and intelligent analysis cannot rule out false alarms triggered by a large number of normal business accesses, which leads to low accuracy of alarm output by the honeypot system. A high degree of manual intervention is required, and it is impossible to quickly match information and deal with it after a security incident occurs

Images