SDN-based virtual honeynet dynamic deployment method and system

Abstract

The invention relates to the technical field of network security, discloses an SDN-based virtual honeynet dynamic deployment method, and solves the technical problems of difficulty in dynamic construction and active induction, inflexibility in configuration and maintenance, poor expandability and low decoy degree of a honeynet in the prior art. The method comprises the steps of A, scanning a honeynet to obtain a network entity, performing clustering analysis according to attributes of the network entity to obtain a clustering result set, and setting a shadow honeypot candidate set according tothe clustering result set; b, performing intrusion detection on the access traffic, and redirecting suspicious traffic according to a matching rule; and C, performing rewards and punishment operations on behaviors of deployed honeypots based on environmental feedback, updating the behavior probability of a set of deployed honeypots, obtaining the current honeynet deployment quality through calculation of the honeynet global threat degree, and then selecting the honeypots from the shadow honeypot candidate set according to the quality scores for dynamic deployment. In addition, the invention also discloses an SDN-based dynamic deployment system for the virtual honeynet, and the system is suitable for dynamic deployment of the virtual honeynet.

Description

technical field [0001] The present invention relates to the technical field of network security, in particular to a virtual honeynet dynamic deployment method and system based on SDN (Software Defined Network). Background technique [0002] With the rapid development of computer and network technology, the security problems we face also follow. Due to the inherent non-equivalence between network attack and defense, traditional passive network defense measures are difficult to deal with the continuously evolving network security threats. Honeypots and honeynets emerged as an active security defense mechanism, and their essence is a camouflage and deception strategy for attackers. They lure attackers by simulating network vulnerabilities or deploying security resources that have no real value, and record the attackers. aggressive behavior. Security technicians can analyze and deduce the intruder's attack strategy and attack intention, and construct a targeted protection stra...

AI Technical Summary

Problems solved by technology

[0005] The technical problem to be solved by the present invention is to propose a method and system for dynamic deployment of a virtual honeynet based on SDN, to solve the problem that in the prior art honeynets are difficult to dynamically build and actively induce, configuration and maintenance are inflexible, scalability is poor, and deception low technical issues

Images