Novel honeypot networking method and honeypot system

Abstract

The invention provides a novel honeypot networking method and a honeypot system, and belongs to the technical field of network security. The invention provides a honeypot networking method, and the method comprises the following steps: listing idle services of a real business host, listing attacker common services, selecting some idle services from the idle services of the real business host according to the attacker common services, deploying the idle services as trapping nodes, deploying one trapping node for each selected idle service, and deploying one trapping node for each selected trapping node; binding the trapping node with the honeypot; when an attacker accesses an idle service, introducing attacker access flow into the honeypot, enabling the honeypot system to analyze the attacker access flow, automatically downloading a countering program and countering the attacker. According to the method, the trapping nodes are deployed on the idle service of the real service host, so that a large number of special servers or special virtual machines created on the idle servers are saved for deploying the trapping nodes, the capture efficiency is high, and the idle service is utilized.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a novel honeypot networking method and a honeypot system. Background technique [0002] Honeypot is a well-known technology in the field of network security. Honeypot is mainly used to induce attackers to attack and then analyze attack behavior. When inducing attackers to attack, traditional honeypots usually need to deploy decoy nodes, bind decoy nodes to honeypots, and forward attacker traffic to honeypots. In traditional honeypots, decoy nodes are deployed on virtual machines On the virtual machine, the virtual machine does not have any business dealings, so as long as there is access to the decoy node, it means that there is an attack. [0003] In the Chinese patent application document CN111756761A, a network defense system, method and computer equipment based on traffic forwarding are disclosed, wherein the system includes: an agent module, a honeypot service modu...

AI Technical Summary

Problems solved by technology

[0005] 1. The characteristics of honeypots are relatively obvious. Experienced attackers can easily identify honeypots

[0006] 2. The capture probability of the honeypot is low. Generally, the proportion of real business hosts and trapping nodes is relatively large, so the capture probability is low

[0007] 3. The network of trapping nodes is generally not under the same network switch as the network of real business hosts. If the attacker scans horizontally based on network equipment instead of horizontal scanning based on IP, the traditional honeynet system will not be able to function

[0008] 4. During the deployment process, traditional honeypots need to increase the resources of trapping nodes, and the cost is high

[0009] 5. The idle service port of the real service host cannot be used, resulting in a waste of resources

[0011] found, and if the establishment of the connection with the honeypot fails, it will lead to the failure of attack capture, and the attack capture rate is low

Images