基于系统和网络特征的蜜罐识别技术

Anti-Honeypot based on system and network characteristic

蜜罐是一个在网络上监视和跟踪非法入侵者的系统,通常认为蜜罐是很难识别的。为了进一步推动蜜罐的发展,讨论了当前的基于系统特征的蜜罐的识别技术,在前人的基础上进一步提出了基于网络特征的新的蜜罐识别技术,即根据目标机提供的服务和请求回显时间来判断目标机是真实的主机还是蜜罐,并用这些技术做了实验,验证了这些技术在实际应用中的可行性。

Honeypot are deployed on networks to detect and monitor misuse of computer and network resources by unauthorized individuals, and it is usually assumed that Honeypots are hard to detect. For the sake of improving the development ofhoneypot, the current anti-honeypot is discussed based on system characteristic, on the foundation of senior people the anti-honeypot based on the network features is put forward, namely according to the service provided by the goal machine and the time echo requests to judge the goal machine is the real machine or honeypot, and the experiment of these technologies confirmed these technologies are feasible in the practical application.