客户端蜜罐原理及应用研究

Client Honeypot Principle and Application Research

文章阐述了用于检测客户端攻击的客户端蜜罐系统原理,并对两类以交互级别区分的客户端蜜罐进行了分析比较。同时,文章还深入分析了代码混淆、url重定向、页面隐藏等技术对客户端蜜罐应用产生的影响以及客户端蜜罐可以采取的相应对策。最后,文章提出了一种可以提高检测效率以及准确率的改进的应用策略。

This paper describes the principle of Client Honeypot system, which is used to detect Clientside attack, analyzes and compares two kinds of Client Honeypot categorized by interaction level. Also, this paper gives an in-depth analysis of influences on the application of Client Honeypot posed by several techniques such as code obfuscation, URL redirection, page cloacking, etc. Meanwhile, the counteractions of Client Honeypot towards these techniques are also presented. Finally, the paper suggests a more efficient and accurate application policy by Client Honeypot.