Honeypot attacker tracing method based on TCP/UDP transparent proxys

Abstract

The invention discloses a honeypot attacker tracing method based on TCP / UDP transparent proxys. The honeypot attacker tracing method comprises the following steps that a service party trap node forwards traffic; the service party trap node dynamically realizes virtual IP simulation; a trap node port achieves scanning and monitoring; the transparent proxy node forwards TCP / UPD traffic; corresponding node positioning is realized through traffic under a multi-forwarding-node scene. According to the method, head information of a transport layer protocol is read at a transparent proxy, attack traffic tracing is achieved, attack traffic is transparently forwarded to a real honeypot service through a real IP of an attacker, and correct request analysis and response of an application layer are achieved; the proxy layer is realized based on TCP / UDP, so that honeypots of all TCP / UDP protocol types are supported.

Description

technical field [0001] The invention relates to the field of network information security and software technology, in particular to a method for tracing the origin of honeypot attackers realized based on TCP / UDP transparent proxy. Background technique [0002] As a security product tool that actively induces hackers, honeypots are playing an increasingly important role in the security product market, and the traceability of attack behaviors against honeypots is the top priority in the development of honeypot products. At present, the way to trace the source of the attacker's behavior on the market is mainly through targeted log collection of service components involved in specific honeypots, such as tomcat, nginx, mysql, etc., to distinguish the source of the user. Information can only be realized by modifying the source code and other means that are difficult to develop. The substantive reason for this problem is that when the attack traffic reaches the application layer, ...

AI Technical Summary

Problems solved by technology

At present, the way to trace the source of the attacker's behavior on the market is mainly through targeted log collection of service components involved in specific honeypots, such as tomcat, nginx, mysql, etc., to distinguish the source of the user. Information can only be realized by modifying the source code and other means that are difficult to develop

The substantive reason for this problem is that when the attack traffic reaches the application layer, due to the different parsing methods of each application service and the different levels of log audit details provided by the service, the application log will have incomplete attacker information.

Images