基于LKM的无线蜜罐实现技术研究

Wireless Honeypot implementation technology based on LKM

为降低真实AP被探测攻击的概率及实现对探测攻击行为进行跟踪研究,提出了一种基于可加载内核模块LKM与无线网卡驱动MadWiFi的无线接入点蜜罐实现技术,随机生成大量的虚假无线接入点并响应连接探测,同时对探测攻击行为进行跟踪分析。实验结果表明该无线蜜罐实现技术达到了预期效果。

For reducing the probability of real APs being attacked, and tracking and studying the action which probing and attacking real APs, the paper presented a Wireless Honeypot implementation technology. It based on LKM technology with wireless network card driver MadWiFi to build a wireless honeypot platform that could deceive attackers by generating a large number of faked wireless APs to reply probing access. It also could track and analyze activities of attackers. The result of the experiment shows this implementation technology can meet the requirements of the honeypot system.