High-interaction sip honeypot system based on phased interaction control

By constructing a highly interactive SIP honeypot system based on phased interactive control, the shortcomings of existing SIP honeypot systems in terms of interaction strategies are solved. This enables progressive induction and comparative analysis of attacker behavior, improves attack behavior analysis capabilities and resource utilization efficiency, and supports the detection of encrypted malicious traffic.

CN122339784APending Publication Date: 2026-07-03SUN YAT SEN UNIV
View PDF 1 Cites 0 Cited by

Patent Information

Authority / Receiving Office
CN · China
Patent Type
Applications(China)
Current Assignee / Owner
SUN YAT SEN UNIV
Filing Date
2026-04-17
Publication Date
2026-07-03

AI Technical Summary

Technical Problem

Existing SIP honeypot systems have shortcomings in their interaction strategies. They are unable to progressively induce and compare attacker behavior at different interaction stages while ensuring system controllability and security. Furthermore, they lack flexible interaction processing logic, making it difficult to simulate real SIP session flows and identify advanced attack behaviors.

Method used

A highly interactive SIP honeypot system based on phased interactive control is adopted. Through a message receiving module, a SIP interactive control module, a session state machine module, and a phase switching control module, a three-stage progressive interactive mode of static foundation, dynamic perception, and phase perception is constructed. The interactive mode is dynamically switched to simulate the signaling flow of a real SIP server, and the recording and statistics module continuously records the characteristics of attack behavior.

Benefits of technology

It enables the dynamic induction and recording of attacker behavior while ensuring system controllability, enhances the ability to analyze the evolution of attack behavior, provides representative attack data to support the detection of encrypted malicious traffic, and improves resource utilization efficiency and interaction depth.

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure CN122339784A_ABST
    Figure CN122339784A_ABST
Patent Text Reader

Abstract

This invention discloses a highly interactive SIP honeypot system based on phased interactive control, comprising: a message receiving module for receiving external SIP requests; a SIP interactive control module supporting multiple interaction modes and generating corresponding responses according to the current configuration mode; a session state machine module for maintaining the SIP session protocol state; a phase switching control module for maintaining phase state variables and dynamically selecting the interaction mode according to preset trigger conditions; and a recording and statistics module for recording request behavior characteristics, interaction logs, and switching logs. This invention achieves runtime schedulable management of interactive capabilities, enabling low-resource-consumption recording of scanning behavior and deep trapping of advanced attacks and collection of complete attack chain data, providing reliable data support for the detection of encrypted malicious traffic.
Need to check novelty before this filing date? Find Prior Art

Citation Information

Patent Citations

  • A Reinforcement Learning-Based Method for Generating Honeynet Deployment Strategies in an Intranet Environment

    CN119341771B