Network security protection system and related method

Abstract

The invention discloses a network security protection system and a related method, and relates to the field of the network security. The network security protection system comprises at least one boundary honeypot and a honeynet connected with at least one boundary honeypot, wherein at least one boundary honeypot is located in a service network, and at least one honeynet is isolated from the service network; at least one boundary honeypot is used for inducing an attacker to attack itself and guiding the attacker to enter the connected honeynet. The network security protection system disclosed by the invention induces the attacker to attack the boundary honeypot, and further guides the attacker to enter the honeynet from the boundary honeypot; since the honeynet is isolated from the servicenetwork, in comparison with the prior art, the attacker can be induced and cheated through the boundary honeypot and the honeynet compared with the prior art on the one hand, the more effective defense can be realized through the known attack way or unknown attack way, and the attack time of the attacker can be delayed to change the attack patch of the attacker, thereby timely blocking the attackon the normal service network by the attacker.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a network security protection system and related methods. Background technique [0002] In the field of network security, intrusion attack methods have developed rapidly in recent years, with various attack methods and novel techniques. Traditional security defense ideas cannot block all external intrusion attacks. It is no longer feasible to rely solely on security defense products to block attacks. [0003] The traditional security defense idea lies in how to rely on border defense equipment to block attacks on the external network, or detect attack traffic through intrusion detection systems (IDS, Intrusion Detection Systems), intrusion prevention systems (IPS, Intrusion Prevention System) and other devices, thereby blocking attacks . However, due to the diversity of attacker methods, attackers enter the intranet by bypassing the border defense, or directly break th...

AI Technical Summary

Problems solved by technology

[0004] At present, traditional intranet security protection products mainly adopt passive security defense methods, including traffic analysis and log review, etc. Whether it is hardware equipment or software, it mainly uses its own rule base matching method to identify whether it is an attack behavior, but There are the following disadvantages: 1. The historical attack characteristics saved in the rule base cannot identify unknown attacks; 2. The accuracy of rule matching is not high, resulting in false negatives and false positives; 3. Existing traditional intranet security products If an attack is found, the attack cannot be blocked in time

Images