Forensic methods in mimic defense

Abstract

The invention provides a forensic method in mimic defense. The existing methods collect incomplete information, and it is difficult to withstand the attacks of multiple malicious visitors at the same time, which affects the practical application benefits, and then affects the effectiveness of mimic defense technology, which is not suitable for practical network scenarios. The method of the present invention comprehensively considers factors such as system resources and work efficiency, and carries out malicious traffic distribution by dynamically estimating the ratio of the load situation of the honeypot to the current processing request. Compared with the existing fixed single honeypot, it has the advantages of more comprehensive information collection and more malicious visitor attacks, and can be widely used in various network architectures.