Active decoy method and system

Abstract

An active spoofing-method includes sampling data stream and matching sampled data with stored character information of hacker attack behavior, repositioning said data stream to spoof network for processing when matched result is decided to be doubt / abnormal data stream, catching data of attack behavior of hacker in spoof network and analyzing out new character information of hacker attack behavior then adding it into stored character information of hacker attack behavior. The spoof system for realizing said method is also disclosed.

Description

technical field [0001] The invention relates to the field of network security, in particular to an active deception method and system. Background technique [0002] The security of computer information systems and networks has always been an important issue facing the industry. In order to resist various hacker attacks from external networks, some typical security technologies and products, such as firewalls and intrusion detection systems, have been applied and deployed in existing networks. Generally speaking, the firewall is placed at the network boundary of the user service network, and plays a rough role in filtering and protecting the data traffic from the external network. Intrusion detection systems are divided into host-based and network-based. The former is deployed on hosts such as servers and workstations to protect local data and systems, while the latter is deployed at key locations on the network or on network devices. , to monitor the incoming and outgoing ...

AI Technical Summary

Problems solved by technology

[0010] The present invention provides an active deception method and system to solve the problems in the prior art that hacker attacks cannot be detected in real time, active deception and self-updated attack detection rules

Images