Honeypot protection system

Abstract

The invention discloses a honeypot protection system, which uses a simulation node to simulate a real node in a protected network, and the simulation node is configured with all idle IP addresses in the protected network, so that the simulation node can be accessed externally as the real node in the protected network. Under the condition, if an attacker accesses the protected network, the attacker does not only access the real node in the protected network but possibly accesses the simulation node, but the simulation node does not run the actual network service, so that the probability that the protected network is attacked is reduced, and the probability that the real server is attacked is also reduced. Meanwhile, the honeypot group can capture the flow data of the access simulation node and the protected network, so that the attack information can be captured by the honeypot, and the network safety is protected and improved.

Description

technical field [0001] The present application relates to the field of computer technology, in particular to a honeypot protection system. Background technique [0002] At present, honeypots have become an important protection method for network security protection. The core of the honeypot is to simulate real asset services and mix them with real services. In addition to simulating real services, honeypots can also record attack-related information in attack responses, providing sufficient information for subsequent attack source tracing. [0003] Since the honeypot is deployed in the service network and mixed with the real service, it is a probabilistic thing for the attacker to touch the honeypot. At present, honeypots are generally used to capture the traffic of the designated port of the actual server, and there are many idle IP addresses in the service network, so the scope of the attacker's attack on the service network is limited to the IP addresses that have been ...

AI Technical Summary

Problems solved by technology

At present, honeypots are generally used to capture the traffic of the specified port of the actual server, and there are many idle IP addresses in the service network, so the range of attackers attacking the service network is limited to the IP addresses that have been used, which leads to the attack probability of the real server relatively bigger

Images