The invention provides a four-honey
threat exploration method for an enterprise
intranet. The four-honey
threat exploration method comprises the following steps: constructing a honey court, a honey point, a honey hole and a honey array in the enterprise
intranet; the honey court is used for monitoring network traffic and carrying out black, white and grey
traffic identification on the network traffic; the honey point is used for carrying out
trapping detection on the network flow passing through the honey point; the honey hole is used for collecting attacker information and performing
traceability countering according to the attacker information; the honey array is in communication connection with the honey court, the honey point and the honey hole, obtains the
safety condition of the enterprise
intranet and the deployment information of the honey court, the honey point and the honey hole, and carries out deployment scheduling according to the
safety condition of the enterprise intranet. The four-honey
system constructed by applying the method fits the enterprise intranet environment and has dynamic
adaptive capacity. A real
system can be effectively isolated, and attacks are prevented from reaching an actual network. Global linkage disposal can be realized for security threats, security intelligence and
attack information can be comprehensively shared, deployment points can be coordinated and adjusted,
source tracing and countering can be quickly carried out, and a secure enterprise-level network environment can be constructed.