Network attack decoy environment construction method based on system simulator

Abstract

A network attack decoy environment construction method based on a system simulator comprises a firewall, an intrusion detection module, a signal detection module, a port redirection module, a virtualenvironment module and a data capture system. The firewall is in communication connection with the signal detection module and the intrusion detection module. The signal detection module is used for communication detection of the port redirection module and the intrusion detection module. The signal detection module is in control connection with the virtual environment module. The data capture system is in communication connection with the virtual environment module. The port redirection module is used for receiving the information sent by the intrusion detection module. According to the method, instruction plug-in mounting and monitoring can be carried out on an upper-layer real Guest operating system; the extended dynamic taint analysis technology is used for tracking network data received at the running moment, identifying illegal use of the network data and detecting network penetration attacks, so that automatic attack feature extraction is supported, a complete real operating system and an upper-layer application program are used for construction of a spoofing environment, and the interaction degree is high.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method for constructing a network attack deception environment based on a system simulator. Background technique [0002] With the continuous development of network technology, network applications are becoming more and more extensive, and the impact is also increasing, but the challenges that follow are also increasing; cyber attacks (Cyber ​​Attacks, also known as cyber attacks) refer to Offensive actions of any kind against computerized information systems, infrastructure, computer networks or personal computing equipment. The honeypot technology proposed based on the active defense theory system has been increasingly valued in the field of network security. The honeypot mainly attracts and tolerates intrusions through a carefully arranged deception environment, and then understands information about attack ideas, attack tools, and attack purposes. , especially whe...

AI Technical Summary

Problems solved by technology

However, this method generally can only provide a limited degree of interaction for the attacker, and does not have the ability to capture some unknown attack methods and security threats; in order to solve the above problems, this application proposes a network attack based on a system simulator Decoy environment construction method

Images