Looking for breakthrough ideas for innovation challenges? Try Patsnap Eureka!

High-interaction SSH honeypot implementation method

An implementation method and high-interaction technology, applied in electrical components, transmission systems, etc., can solve the problems of low interaction of medium and low interaction SSH honeypots, update and change SSH attacks, and insufficient decoy, so as to improve the value of honeypots, The effect of reducing complexity and facilitating intuitive observation

Active Publication Date: 2019-12-10
HOHAI UNIV
View PDF4 Cites 8 Cited by
  • Summary
  • Abstract
  • Description
  • Claims
  • Application Information

AI Technical Summary

Problems solved by technology

[0004] The technical problem to be solved by the present invention is to overcome the defects of the prior art, provide a kind of SSH attack that can solve the passive defense technology that cannot be continuously updated due to the bottom of the valley, and the interaction degree of the medium and low interaction SSH honeypot is not high and the deception is insufficient. A high-interaction SSH honeypot implementation method to improve the security defense capability of the SSH service by being easily seen through and other defects

Method used

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View more

Image

Smart Image Click on the blue labels to locate them in the text.
Viewing Examples
Smart Image
  • High-interaction SSH honeypot implementation method
  • High-interaction SSH honeypot implementation method
  • High-interaction SSH honeypot implementation method

Examples

Experimental program
Comparison scheme
Effect test

Embodiment Construction

[0029] The present invention will be further described below in conjunction with the accompanying drawings. The following examples are only used to illustrate the technical solution of the present invention more clearly, but not to limit the protection scope of the present invention.

[0030] Such as figure 1 and figure 2 As shown, a kind of highly interactive SSH honeypot implementation method provided by the present invention: comprises the following steps:

[0031] Step 1: Try to connect to the SSH port of the system to determine whether there is SSH service, and if there is SSH service, go to step 2.

[0032] Step 2: Use the logit function and the authctxt structure in OpenSSH to capture the authenticated username / password during password identity authentication. The specific operation steps are: (1) decrypt the password information on the server; (2) store the password in the authctxt structure (3) record the user name and password in the authctxt structure through the...

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

PUM

No PUM Login to View More

Abstract

The invention discloses a high-interaction SSH honeypot implementation method which comprises the following steps: connecting a system SSH port, judging whether SSH service exists or not, and enteringthe next step if the SSH service exists; capturing an authenticated user name / password during password identity authentication by utilizing a logit function and an authctxt structure body in the OpenSSH; after the password is successfully authenticated, modifying related module codes by utilizing the characteristic that SSH service processes client data through a pipeline and a user processing interactive session module, so as to record the shell password; controlling the outflow flow of the honeypot system, including two processes of limiting an external data packet and inhibiting an external attack packet; and analyzing, processing and displaying the data captured by the honeypot system by utilizing a javaweb technology. According to the high-interaction SSH honeypot implementation method, the defects that a passive defense technology cannot be used for SSH attacks which are continuously updated and changed due to valleys, and medium and low interaction SSH honeypots are low in interaction degree, insufficient in decorativeness, easy to be broken and the like can be overcome, and the security defense capability for SSH services is improved.

Description

technical field [0001] The invention specifically relates to a high-interaction SSH honeypot implementation method, which belongs to the technical field of active defense in network information security. Background technique [0002] SSH (Secure Shell) can be used for remote login sessions and provide security services for other network services, and has become an indispensable part of corporate life. With the widespread use of this protocol, there are more and more malicious attacks against this service, which poses a huge challenge to network security. Nowadays, how to deal with malicious attacks against the service and take appropriate protective measures has become an important research topic in SSH service security. According to the attacker's habit of invading the system through the SSH service, real-time monitoring and capture of the attacker's behavior during the attack process, and the extracted intrusion behavior to understand the attack method used by the attacke...

Claims

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

Application Information

Patent Timeline
no application Login to View More
Patent Type & Authority Applications(China)
IPC IPC(8): H04L29/06
CPCH04L63/083H04L63/1416H04L63/1491H04L63/168
Inventor 石爱业丁日升
Owner HOHAI UNIV
Who we serve
  • R&D Engineer
  • R&D Manager
  • IP Professional
Why Patsnap Eureka
  • Industry Leading Data Capabilities
  • Powerful AI technology
  • Patent DNA Extraction
Social media
Patsnap Eureka Blog
Learn More
PatSnap group products