基于蜜罐的主动网络安全系统的研究与实现

Research and Implementation of an Active Network Security System Based on Honeypots

采用自动的大规模扫描,在发现系统漏洞后,能够使对手在短时间内攻破计算机系统。传统的蜜罐系统在处理这些问题时有很多不足,因为其签名是可检测的。针对这些不足,本文从另一个角度构造了一个基于蜜罐的主动网络安全系统(Active Network Security System,ANSS)的诱骗系统。 ANSS位于真实的网络环境中,可以自始至终捕获到黑客的行为。仿真实验表明,ANSS使网络的安全性能达到了一个较高的水平,对入侵行为的监控和预防有着重要的意义。

Exploit automation and massive global scanning for vulnerabilities enable adversaries to compromise computer systems shortly after vulnerabilities become known. Traditional honeypots have shortcomings to deal with these problems because their signatures can be inspected. Aiming at current research state, the paper constructs an Active Network Security System (ANSS) from another point of view, i.e., ANSS situated in a real network circumstance. ANSS is the same as other systems in Internet, and it can capture actions of hacker from beginning to end. The simulation results indicate that ANSS can elevate network's security performance to a higher level and ANSS has important impact on forecast and monitor attack activities.