Method for realizing chaff network data flow heavy orientation

Abstract

The method includes following steps: all data accessing into the network are redirected , if the data is from Internet, the source address will be checked to decide if it is in list of questionable IP, if it is in the questionable IP list, its destination MAC address is replaced by the MAC address of the host corresponding to trap network, then transmitting it to trap network; if it is not in the questionable IP address list, it will be checked by using fire wall rule or the rule of instruction detection system, if it doesn't match the detection rules, it means the data is normal, then it will be sent to the protected network, if it matches the detection rules, it means the data is questionable, its destination address will be added into the questionable IP list, then it will be sent to trap network; if all data is from LAN, they will be directly sent out through Internet interface; if the data is from Honeyport, its source MAC address will be replaced by MAC address of corresponding host in LAN, then it will be sent out through Internet interface.

Description

technical field [0001] The invention relates to a method for protecting a network, in particular to a method for realizing decoy network data flow redirection. Background technique [0002] In recent years, the Internet and communication networks have developed rapidly around the world, which has had a great impact and change on the way of life of human society, and the subsequent network information security issues are becoming more and more important . The emergence of means such as network hackers, viruses, information theft and interference have made network security face serious challenges. The world pays a huge price for it every year, up to hundreds of millions of dollars, such as hacked bank account systems, virus outbreaks, and military network interference. [0003] Traditional network security technologies mainly include firewall technology and intrusion detection system. The main function of the firewall is to prevent illegal intruders from entering the networ...

AI Technical Summary

Problems solved by technology

But people are faced with new problems: 1) due to the firewall technology and intrusion detection system shutting out suspicious persons, the attackers cannot succeed, which will make the attackers constantly seek new technical means to attack and increase network security. Difficulty and untestability of protection

In this case, deceiving the network is a kind of mode in which willing people take the bait in a certain sense. It passively waits for the hacker's intrusion, and then records its every move. Doesn't help protect the LAN

Images