Active trapping method based on behavior capturing

Abstract

The invention brings forward an active trapping method based on behavior capturing. A trapping system is established in a formulated network area. The active trapping method comprises the following three links: (1) an active trapping system is established in an advance defense of a network defense system, and an active trapping engine technology is adopted; an active trapping engine, target cheating, attack capturing, attack control, attack analysis and characteristic extracting are established in multiple systems included by a computer; (2) a dynamic depth target cheating attack behavior is utilized to trap a real attack objective of an attacker; (3) and the active trapping system makes the attacker be sure of the attack target according to the aforementioned judgment results so that the real attack objective of the attacker is trapped. According to the active trapping method based on behavior capturing, known and unknown attack behaviors can be captured, the security state of the whole network is mastered and the network security level is enhanced.

Description

technical field [0001] The invention specifically relates to an active trapping method based on behavior capture, which is used for active, efficient and system-level security defense on PC terminals, servers and workstations on the network. [0002] Background technique [0003] Nowadays, with the wide application of network technology, network attack incidents emerge in an endless stream, and network security has become the focus of today's research hotspots and social concerns. Existing network security technologies with firewalls and intrusion detection systems (IDS) as the core defense technologies usually lag behind. in a variety of attack techniques. As a new network security technology, honeypot technology has gradually attracted people's attention. It adopts a proactive approach, attracts attackers with its unique features, and at the same time analyzes various attack behaviors of attackers and finds effective countermeasures. [0004] Data capture technology is ...

AI Technical Summary

Problems solved by technology

[0006] Although the honeypot technology can make up for the deficiencies of the original passive security defense with the cooperation of network firewalls, intrusion detection systems and other security measures, it still has some insurmountable shortcomings: the captured data is not comprehensive, not targeted, difficult to Analyze the real attack data, and cannot effectively protect against unknown attacks

Images