Attack countering method and system based on RDP disk mapping

Abstract

The invention provides an attack countering method and system based on RDP disk mapping, and belongs to the technical field of network security. According to the method, an IP, a login account and a login password of an RDP server are stored in enterprise network assets to serve as baits, and an attacker can log in the RDP server once obtaining the baits, the attacker. Disguised file baits are stored in the RDP server so as to induce the attacker to copy and paste the file baits to an attacker host. The copying and pasting operation of the attacker fail due to the fact that the RDP server closes the copying and pasting function, a system local group strategy of the RDP server can induce the attacker to conduct disk mapping, the file baits can be automatically executed when the attacker logs in the RDP server, so that an executable file is implanted into the attacker host, and countering of the attacker is completed. According to the method, executable files such as Trojans are reversely implanted into the attacker computer by utilizing the disk mapping function of the RDP, so that the effect of controlling the attacker computer is achieved.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to an attack countermeasure method and system based on RDP disk mapping. Background technique [0002] There are more and more network attacks and more and more attackers, but the traceability methods for the attackers are often difficult to be effective, including the traceability of the attacker's IP, the traceability of the device fingerprint, and so on. Therefore, on the basis of source tracing, we need more effective means to counter attackers. There are not many existing means of countering attackers, and they are often based on honeypot technology. [0003] In the Chinese patent application document CN108134797A, a system and method for implementing attack countermeasures based on honeypot technology are disclosed. The system includes a honeypot host, a honeypot environment deployment module, a countermeasure mechanism setting module and a countermeasure module serv...

AI Technical Summary

Problems solved by technology

[0006] 1. Based on honeypot technology, the cost is high and the effect is uncontrollable

[0007] 2. Simulate the scheme of secretly obtaining the attacker's information and attack behavior in the virtual network, without giving specific techniques to counter the attacker

[0008] means, irrelevant

Images