Method for realizing dynamic volume expansion and shrinkage of honey net

Abstract

The invention relates to the technical field of honeypots, and provides a honeynet dynamic capacity expansion and shrinkage implementation method. The method comprises the following steps: combining honeynet dynamic capacity expansion and shrinkage management service with honeypot system data processing service, and determining whether capacity expansion needs to be performed or not and the quantity of the capacity expansion according to comparison of time consumed by an attacker for breaking through a previous area and conventional consumed time; triggering the expansion of the honeynet whenthe conditions are met, matching the number of expanded honeypots with the technical ability of an attacker, and reasonably scheduling system resources; when the attacker is judged to leave the honeynet, reducing the volume of the honeypot, and recovering and releasing resources.

Description

technical field [0001] The invention relates to the field of honeypot technology, in particular to a method for realizing dynamic expansion and contraction of a honeynet. Background technique [0002] Honeypot technology generally pretends to be a vulnerable network service and responds to the attack connection. It can be used to deceive the attacker, delay the attack progress, increase the attack cost, and monitor it. In practical applications, multiple honeypots are usually built in the same network to form a honeynet, which provides a real and rich business environment for attackers and increases the difficulty of identifying attackers. [0003] The enterprise intranet network architecture is generally divided into different functional areas such as DMZ area, office area, and core area, and each functional area will be divided into different subnets according to departments. [0004] The network architecture of the honeynet will be combined with the network architecture ...

AI Technical Summary

Problems solved by technology

[0013] a. The reward and punishment mechanism for the honeypot set will make the deployment of new honeypots and the redirection of traffic more and more inclined to the attacker's target content. This kind of reinforcement learning method makes it easier for the attacker to move laterally , on the contrary, it is easy to arouse the alert of the attacker. After the alert of the attacker, the purpose of delaying the attacker for a long time will not be achieved, and the attacker may turn to look for the real business network

Images