Network attack processing method and device

Abstract

The embodiment of the invention provides a network attack processing method and device, wherein the device comprises a honeypot network and a service system which are isolated from each other, and the method comprises the steps of receiving a honeypot deployment strategy which comprises a monitoring port and a monitoring mode, wherein the honeypot deployment strategy is generated by service operation information of a service process operated on the service system; and monitoring an attack request by a honeypot process deployed on the service system through the monitoring port, and processing the attack request according to the monitoring mode or forwarding the attack request to the honeypot network for processing. According to the embodiment of the invention, the honeypot deployment strategy is automatically generated through the service operation information of the service system, so that the service system can deploy the honeypot process based on the honeypot deployment strategy, the honeypot deployment efficiency is improved, and since the honeypot process can forward the monitored request to the honeypot network for processing according to the monitoring mode, a honeypot does not need to be deployed in the service system, and the honeypot deployment cost is reduced.

Description

technical field [0001] The embodiments of the present invention relate to the technical field of information security, and in particular, relate to a network attack processing method, a network attack processing device, a network attack processing system, an electronic device, and a computer-readable storage medium. Background technique [0002] A honeypot is a system that arranges some hosts, network services or information as bait to lure attackers to attack, and then captures and analyzes the attack behavior of the attacker (hacker) to understand the tools and methods used by the attacker , inferring attack intentions and motives, allowing defenders to clearly understand the security threats they face, and correspondingly enhance security protection capabilities or give timely warnings. Among them, a network formed based on multiple honeypots is called a honeypot network. [0003] In order to increase the probability of an attacker attacking a honeypot, a dedicated devel...

AI Technical Summary

Problems solved by technology

[0003] In order to increase the probability of an attacker attacking a honeypot, a dedicated developer needs to prepare multiple honeypots and then deploy them on the server. In this traditional honeypot deployment method, the number of honeypots may increase over time. And increase, not only the cost is very high, but also the efficiency of honeypot deployment is low

Images