Malicious sample cultivation high interaction to low interaction system and method

Abstract

The invention discloses a malicious sample cultivation high interaction to low interaction system. The system comprises a high interaction module which is used for obtaining first packet data of malicious behavior network communication based on at least two secondary reoperation malicious behaviors in an operation environment, wherein the unchanged first packet data in an operation process is analog replay data; and a low interaction module which is used for sending the first packet data to the malicious behaviors of the same family based on the analog replay data and monitoring and obtaining the network information of the behavior network communication. According to the system and the method, the technical problem that in the prior art, the network information of samples is obtained in a high interaction mode, the efficiency of monitoring a command and controlling a server or attack behaviors is low, and an operation environment is realized through consumption of a great number of network and physical resources to achieve an effect is solved.

Description

technical field [0001] The present invention relates to the technical field of computer security, and more specifically relates to a system and method for transforming high-interaction into low-interaction in malicious sample breeding honeynet. Background technique [0002] In the prior art, farming honeynet technology can be divided into two categories according to the interaction degree of farming honeynet data: low-interaction farming honeynet and high-interaction farming honeynet. The low-interaction breeding honeynet adopts simulation technology, there is no real operating system and services, and the degree of interaction is low. It can only simulate the response behavior of the operating system and applications based on known vulnerabilities; the high-interaction farming honeynet runs on the real operating system. Deploying real applications can construct a real service environment and capture richer attack data. [0003] At present, researchers need to breed a large...

AI Technical Summary

Problems solved by technology

The efficiency of high-interaction implementation is relatively low, and the risk is high. It needs to consume a lot of network and physical resources to realize the operating environment to achieve the effect. The implementation of long-term high concurrency is expensive.

Images