Extensible honeypot traceability countering method in power industry

Abstract

The invention discloses an extensible honeypot traceability countering method for the power industry. The method comprises the following steps: carrying out attack intelligence information aggregation on monitored attack behaviors; constructing a traceability interface; constructing counter Trojan horse; and fusing the constructed traceability interface and countering Trojan horse into a honeypot template as honeypot node deployment so as to perform traceability countering aiming at the characteristics of the electric power information system. According to the invention, active collection and convergence of attack information and intelligence information integration are realized; a code packaging and reconstructing method is applied to construct a user-defined traceability interface set and kill-free countering Trojan horse, and a traceability countering module is decoupled from an original honey pot function, so that extension of the honey pot function is realized; and finally, a novel honeypot template is constructed by using a self-defined traceability interface set and a Trojan horse countering tool to form a diversified attack trapping combination, and the combination is designed, arranged and deployed to a real attack intrusion link according to an actual application scene of the power industry, so that the method has certain expansibility and practicability.

Description

technical field [0001] The invention belongs to the field of network security in the electric power industry, and in particular relates to an expandable honeypot traceability countermeasure method in the electric power industry. Background technique [0002] With the changes in the international situation, the competition among countries in cyberspace has become more intense. Network security incidents in recent years have shown that my country's Internet network security situation is gradually severe, and key information infrastructure represented by power systems has become an important target of network attacks. Therefore, it is particularly important to strengthen dynamic defense and active defense capabilities. [0003] Honeypot technology is an active protection technology with the concept of "deception and trapping" as the core. It forges services by establishing special networks, terminals, services and data to attract intrusion behaviors, thereby obtaining informati...

AI Technical Summary

Problems solved by technology

[0004] The disadvantage is that the existing mainstream honeypot system has obvious characteristics, which are easy to be identified and marked by attackers. At the same time, there are problems such as easy failure of the traceability interface and difficult reconstruction of anti-Trojan horses.

Images