Active trapping security defense method and system, electronic equipment and storage medium

Abstract

The embodiment of the invention discloses an active trapping security defense method and system, electronic equipment and a storage medium, and relates to the technical field of terminal security. The method comprises the following steps: monitoring a bait file on a first target host; if it is monitored that a user host executes a preset operation instruction on the bait file, triggering a defense strategy for capturing identification information of the user host and identification information of an attack host; the first target host and the user host are located in the same local area network, and the user host is a controlled object of the attack host. According to the scheme, isolation of an inner net and an outer net is not needed, information of attackers can be conveniently trapped, and therefore security defense can be further achieved.

Description

technical field [0001] The present invention relates to the technical field of terminal security, in particular to an active entrapment security defense method, system, electronic equipment and storage medium. Background technique [0002] One of the tasks of network security protection is to ensure the security of electronic data and prevent it from being stolen by network attackers. With the iterative update of cyber threat means, there are always loopholes and vulnerabilities that can be exploited by cyber attackers on computers, smartphones and other electronic devices, which makes the security protection requirements for data generated or stored on electronic devices higher . [0003] Most of the existing security protection means isolate the internal (internal local area network) and external network (external wide area network) for data protection. [0004] In the process of realizing the invention, the inventor found that: although the above-mentioned method of iso...

AI Technical Summary

Problems solved by technology

[0004] In the process of realizing the invention, the inventor found that: although the above-mentioned method of isolating internal and external networks for data security protection can be used to protect data such as files with a higher level of importance, it is not relatively high for the level of importance. For data such as files that need to be kept confidential, it is somewhat inconvenient to adopt the complete isolation protection method of internal and external networks; in addition, in some scenarios that need to induce attackers to attack, the isolation of internal and external networks also makes it impossible to effectively trap attacker

Images