CentOS high-interaction honeypot system based on Docker and implementation method thereof

Abstract

The invention discloses a CentOS high-interaction honeypot system based on Docker, and the system comprises: a basic service module which is used for deploying a large number of other basic services based on a basic CentOS mirror image, so as to simulate the operation environment of a real host, and improve the interactivity between a honeypot and a hacker; a vulnerability service module which isused for remaining common vulnerabilities and increasing the mode of entering the honeypot system while increasing the number of services in the honeypot system, reducing the difficulty of entering the honeypot system, enabling an attacker to enter the honeypot and collecting data of the attacker; and a data aggregation module which is used for analyzing the operation of the attacker after entering the honeypot system, aggregating all the operations performed by the same user in the honeypot system into one session id through a remote IP, a remote port, a process number and an operation time quadruple, analyzing the operation intention of the attack author and tracing an attack path. The invention further provides an implementation method of the CentOS high-interaction honeypot system based on the Docker. The CentOS high-interaction honeypot system based on the Docker plays a role in protecting real host service.

Description

technical field [0001] The invention relates to the technical field of computer network security, in particular to a Docker-based CentOS high-interaction honeypot system and an implementation method thereof. Background technique [0002] Honeypot technology is a technology to deceive Internet attackers. Generally, it can be considered that a honeypot is an unused but closely monitored network host, which contains false high-value resources and some loopholes to attract intruders to attack the honeypot host in order to protect the real host. At the same time, the honeypot can record all the instructions of the hacker to attack, so as to formulate a means of defense against attacks for use by the real host. Using honeypot technology can resist unknown attacks to a certain extent and enhance the protection ability of the actual system. [0003] Most of the existing honeypot technologies are data analysis technologies of low-interaction honeypots, or a more complex honeypot sy...

AI Technical Summary

Problems solved by technology

However, there are few studies on CentOS high-interaction honeypots

Although there are already some open source honeypot technologies based on Docker, which simulate some services of CentOS, these honeypots have several types of defects. First, they are not easy to attract hackers, and second, they have low interaction with hackers. , there may be no hacker entering or the hacker will leave the system after a small amount of operation after entering. Third, the operations of different hackers in the honeypot are not easy to distinguish. These factors will eventually make it difficult to collect effective data for analysis.

Images