Mimicry honeypot fingerprint confusion system and method and SDN network architecture thereof

Abstract

The invention belongs to the technical field of communication safety, and especially relates to a mimicry honeypot fingerprint confusion system and method and an SDN network architecture thereof. Thesystem comprises a control center which is deployed on a distributor and is used for maintaining the working state of a honeypot, dynamically generating a honeypot scheduling rule according to the suspicious traffic behavior characteristics fed back by the honeypot, and starting and closing the corresponding honeypot according to the scheduling rule; a distributor which is deployed between a honeypot group and a suspicious traffic source and is used for receiving the outputted suspicious traffic, recording the suspicious traffic, broadcasting the suspicious traffic to each honeypot in the honeypot group, receiving response messages from the honeypots, and transmitting the response messages to the suspicious traffic source as false response messages for replying to a corresponding attacker,wherein the honeypot group contains multiple types of honeypots. The method utilizes a dynamic transformation mechanism to comprehensively schedule a plurality of honeypots, reduces the influence onthe safety performance of the network from a condition that a single honeypot system is controlled by the attacker, and improves the reliability of the entire system.

Description

technical field [0001] The invention belongs to the technical field of communication security, and in particular relates to a mimetic honeypot fingerprint obfuscation system, method and SDN network architecture thereof. Background technique [0002] With the rapid development of network technology, network security threats are also emerging in an endless stream. Attackers can attack network weaknesses and loopholes to carry out activities such as information theft and system destruction, which seriously threatens network security. A honeypot system is a network resource that is deployed on the network and has the value of attracting and trapping. Its value can only be reflected when it is attacked or compromised. A honeypot is a deception technology aimed at protecting core network components. It only contains false sensitive data and cannot provide normal services to the outside world. Generally, a honeypot can be a network, a host, a service, useless data items in a datab...

AI Technical Summary

Problems solved by technology

[0004] For this reason, the present invention provides a mimetic honeypot fingerprint obfuscation system, method and its SDN network architecture, which solves the problems that the existing honeypot technology is difficult to resist fingerprint sniffing and isolated static defense. Honeypots are scheduled comprehensively, reducing the impact of a single honeypot system being controlled by an attacker on network security performance, thereby greatly improving the reliability of the entire system

Images