A high-interaction ssh honeypot implementation method

Abstract

The invention discloses a high-interaction SSH honeypot implementation method, comprising the following steps: connecting the system SSH port, judging whether there is SSH service, and entering the next step with the SSH service; using the logit function and the authctxt structure in OpenSSH in Capture the authenticated user name / password during password authentication; after the password authentication is successful, use the SSH service to process the client data through the pipeline and the user processing interactive session module, and modify the relevant module code to complete the shell Record passwords; control the outgoing flow of the honeypot system, including the two processes of external data packet restriction and external attack packet suppression; use javaweb technology to analyze, process and display the data captured by the honeypot system. A high-interaction SSH honeypot implementation method of the present invention can solve the SSH attack that passive defense technology cannot be continuously updated due to the bottom of the valley, and the low-interaction SSH honeypot has low interaction degree, insufficient deception, and is easy to be seen through. Improve the security defense capability of the SSH service.

Description

technical field [0001] The invention specifically relates to a high-interaction SSH honeypot implementation method, which belongs to the technical field of active defense in network information security. Background technique [0002] SSH (Secure Shell) can be used for remote login sessions and provide security services for other network services, and has become an indispensable part of corporate life. With the widespread use of this protocol, there are more and more malicious attacks against this service, which poses a huge challenge to network security. Nowadays, how to deal with malicious attacks against the service and take appropriate protective measures has become an important research topic in SSH service security. According to the attacker's habit of invading the system through the SSH service, real-time monitoring and capture of the attacker's behavior during the attack process, and the extracted intrusion behavior to understand the attack method used by the attacke...

AI Technical Summary

Problems solved by technology

[0004] The technical problem to be solved by the present invention is to overcome the defects of the prior art, provide a kind of SSH attack that can solve the passive defense technology that cannot be continuously updated due to the bottom of the valley, and the interaction degree of the medium and low interaction SSH honeypot is not high and the deception is insufficient. A high-interaction SSH honeypot implementation method to improve the security defense capability of the SSH service by being easily seen through and other defects

Images