对未知攻击进行检测的蜜罐系统的实现

Implementation of honeypot system for detecting unknown attacks

针对当前防火墙和入侵检测系统不能够对未知攻击作出有效的判断,而造成信息误报和漏报的问题,提出了一种蜜罐系统结构,通过过滤掉已知攻击,在系统调用层,采用攻击签名机制,实现对未知攻击的检测和分析。

The current firewaU and intrusion detection system cannot effectively discern the unknown attacks, so it leads to false positives and negatives for the information. Therefore, a kind of honeypot system was proposed, by attack signature mechanism for detecting and analyzing unknown network attacks in system call level.