Active network defense method and system

Abstract

The invention relates to an active network defense method and a system. The method for realization comprises the steps as follows: in step a, at least a server or a router with obvious security vulnerabilities is set in a network in a virtual manner; in step b, a network attacker obtains an administrator command interpreter of the server or the router by utilizing the vulnerabilities; and in step c, the command interpreter runs on the network attacker for monitoring, and the running process is recorded for obtaining evidence.

Description

technical field [0001] The present invention relates to a computer network security technology, in particular to a method of setting up a virtual machine in the network, inducing a hacker to scan and attack the virtual machine, correspondingly recording information such as the hacker's whereabouts and attack methods, and confusing Cyber ​​defense methods and systems for hackers. Background technique [0002] In computer network, firewall, intrusion detection and vulnerability scanning are the basic means to protect network security. The firewall is installed on the periphery of the protected network to defend against external attacks, and the intrusion detection system is installed inside the protected network to defend against attacks from within the network. However, these technologies are all passive defenses, and only when hackers launch an attack, will they respond. Therefore, in order to effectively defend, it is necessary to understand some information about hackers....

AI Technical Summary

Problems solved by technology

Under normal circumstances, no business applications are deployed on the honeypot, so the communication in and out of the honeypot is unauthorized

Images