Attack perception method, device and equipment based on honeypot induction and medium

Abstract

The invention discloses an attack perception method, device and equipment based on honeypot induction and a medium. The method comprises the following steps: filtering a captured data package to obtain a first target data package, and outputting the first target data package to a user mode process; determining a target communication induction strategy corresponding to the first target data packetin a user mode process, and communicating with a source Internet protocol address corresponding to the first target data packet based on the target communication induction strategy to capture at leastone second target data packet sent by the source Internet protocol address; and determining the first target data packet and / or the second target data packet corresponding to the first target data packet as a to-be-analyzed data packet, analyzing the to-be-analyzed data packet based on a preset analysis rule set, and analyzing an attack behavior according to an analysis result. The system has thedual advantages of an intrusion detection system and a honeypot system, attack information can be captured more comprehensively, and the safety of the network is protected.

Description

technical field [0001] The invention relates to the field of intrusion detection, in particular to an attack perception method, device, equipment and medium based on honeypot induction. Background technique [0002] The intrusion detection system refers to a system that monitors the operating status of the network and the system according to a certain security strategy, discovers various attack attempts, attack behaviors or attack results as much as possible, and raises an alarm. The traditional intrusion detection system matches the intrusion behavior through the security policy, so as to achieve the purpose of detection. However, this traditional detection method cannot induce the attack behavior, and cannot identify the attack behavior that fails to match the security policy. Contents of the invention [0003] In order to solve the technical problem that the traditional detection method in the prior art cannot induce the attack behavior and cannot recognize the attack ...

AI Technical Summary

Problems solved by technology

[0003] In order to solve the technical problem that the traditional detection method in the prior art cannot induce the attack behavior and cannot identify the attack behavior that fails to match the security policy

Images