Honeypot system and management method thereof

Abstract

The application provides a honeypot system and a management method thereof. A trapping node captures a first attack request of an attacker and forwards the first attack request to an intermediate proxy layer. The intermediate proxy layer edits the first attack request into a second attack request and forwards the second attack request to a corresponding first honeypot instance. The first honeypot instance controls a corresponding target process to execute an attack instruction of the second attack request, establishes a first mapping relationship between the target process and an identifier ID of the attacker, establishes a second mapping relationship between a file system operation log and the target process, and uploads the first mapping relationship, the second mapping relationship, the file system operation log and the second attack request to a message queue if a reverse shell appears. The identifier ID of the attacker and the file system operation log can be associated through the first mapping relationship and the second mapping relationship, the target process and the file operated by an attack source IP corresponding to the identifier ID of the attacker can be obtained, and the attack behavior of the attacker can be tracked.

Images