Network security system based on honeypot technology

Abstract

The invention discloses a network security and protection system based on a honeypot technology. The network security and protection system comprises a software defined network control subsystem and a cheating server, the software defined network control subsystem comprises a virtual network topology module and an IP randomization module; the virtual network topology module is mainly responsible for generating a virtual network topology and distributing a flow table according to the specification of the virtual network topology; the IP randomization module is responsible for coordinating address transformation of a host and a bait node in a network; the spoofing server is responsible for making a response according to the specification of the virtual network view to spoofing the malicious scanning program. According to the method, the dynamic nature, the randomness and the uncertainty of the system are increased, so that an attacker spends more time on false resources, the attack difficulty and the attack cost of the attacker are further improved, the defense efficiency and the security of the system are effectively enhanced, and the method has the advantages that infrastructures for network system development and management are flexible and effective, the operation overhead is small, and the implementation is easy. And continuous network investigation attacks can be effectively resisted.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a network security system based on honeypot technology. Background technique [0002] While the Internet brings high efficiency and convenience to people, the problem of network security is also becoming more and more serious. Relevant units integrate various information systems, data resources and Internet resources into an information management platform through portal websites, and establish information channels for external customers and internal personnel, so that various information stored internally and externally can be released. For attackers, these portals become their entry point into the internal network. Most traditional network defense technologies protect network and system security through intrusion detection, firewall and other technologies, but these technologies are static. Evolutionary attackers repeatedly analyze and infiltrate the target's vulnera...

AI Technical Summary

Problems solved by technology

However, the existing network deception defense systems based on honeypots and honeynets have defects such as insufficient deception, static nature, complex deployment and difficult maintenance.

Evolved attackers can still bypass the defense mechanism after careful detection and analysis, and once the honeypot fails, not only cannot protect the network system, but will even be used by the attacker as a springboard to attack other resources

Images