Method for controlling data in active defense system of Honeynet

Abstract

The invention relates to a method for controlling data in the active defense system of Honeynet by keeping the counting statistics for failed connections, wherein, every IP source address is provided with a counting statistic on the record thereof kept by a short-term counter: if the counting value of the short-term counter exceeds the threshold, that the worm abnormal behavior is detected is determined and the data packets sent from the IP source address are controlled, but if not, the multi-round detection mechanism is triggered and the record of the IP source address is kept in a long-term detection list; and if the timeout happens to a long-term counter, and the counting value thereof exceeds the threshold, that the worm abnormal behavior is detected is determined and the data packets are controlled, and if not, that the data packets are normal and can be released is determined. The method has the advantages that unknown or stealth aggressive behaviors which intentionally slow down the rate of the aggressive behaviors to bypass the control of firewalls, as well as low-rate aggressive behaviors can be identified, particularly, the novel aggressive behavior pattern invented by hackers can be analyzed and identified.

Description

technical field [0001] The invention relates to a data control method in a honeynet active defense system, belonging to the technical field of information security. Background technique [0002] With the popularization and promotion of network information construction, security issues have gradually become a research focus and hot spot in the field of network technology. As an active network defense technology, the honeynet system tricks hackers into attacking virtual systems and conducts comprehensive and in-depth tracking and analysis of hacker attacks and malware activities to achieve the purpose of protecting hosts. [0003] my country discovered the first computer crime in 1986. By 1990, 130 cases were discovered and cracked, and 1,200 cases were discovered in 1993-1994. According to the 2008 National Information Network Security Status and Computer Virus Epidemic Investigation Report of the Ministry of Public Security, the proportion of information network security i...

AI Technical Summary

Problems solved by technology

Existing honeynet technology cannot detect unknown or concealed attacks that deliberately slow down the attack rate in order to bypass the control of the firewall, and it is also helpless to intelligently identify slow attack behaviors, which may mistake malicious data carefully constructed by hackers let go

Images