Honey needle and honey pot device and deployment method thereof

Abstract

The invention discloses a honey needle and honey pot device and a deployment method thereof. The system comprises a plurality of honey needles which are deployed in a service network and receive attack access, a plurality of honey pots which are isolated from the service network and form a network topology, a flow transponder which is used for bridging the honey needles and the honey pots, and a honey pot controller which is connected to the flow transponder and is used for configuring a flow forwarding rule and creating and deploying the honey pots, the honeypot is isolated from the service network and forms a network topology, so that the safety is higher, the honeypot only needs to forward to a specific port during forwarding and then is distributed by the flow transponder, and the forwarding exposure surface is reduced; in addition, the data packet between the honey needle and the traffic transponder belongs to encrypted traffic, so that the risk of packet capture in the middle is reduced.

Description

technical field [0001] The invention relates to the field of computer network security, in particular to a honey needle and honey pot device and a deployment method thereof. Background technique [0002] Honeypot technology is essentially a technology to deceive the attacker. By arranging some hosts, network services or information as bait to induce the attacker to attack them, the attack behavior can be captured and analyzed to understand the attack. The tools and methods used by the defender, inferring the intention and motivation of the attack, can allow the defender to clearly understand the security threats they face, and enhance the security protection capability of the actual system through technical and management means. [0003] The existing technology mainly relies on deploying the honeypot directly in the existing network, or directly forwarding the deployed probes to the corresponding honeypot, but there are mainly the following problems: 1. If the honeypot direc...

AI Technical Summary

Problems solved by technology

[0003] The existing technology mainly relies on directly deploying honeypots in the live network, or directly forwarding the deployed probes to the corresponding honeypots, but there are mainly the following problems: 1. If the honeypots directly deployed in the live network need to occupy A large number of resources, high cost, and complex deployment; 2. If the honeypot is directly deployed on the live network, it is limited by the type of honeypot and cannot flexibly open ports for different services; 3. The honeypot deployed in the actual business network Honeypots, even with various defensive measures, will directly break through to the existing network once exploited by attackers; 4. Limited by the hardware structure of a single device, honeypots cannot be deployed in all areas of the unit network;

Images