入侵诱骗技术中诱骗环境的研究与实现

Research and Implement of Deception Environment in Intrusion Deception Technology

入侵诱骗技术变被动防守为主动防御,其中诱骗环境是真实系统的替身,是整个入侵诱骗系统的核心。在对现有的诱骗环境构造技术进行分析、研究后,针对其缺点,对诱骗环境进行高度的抽象,将其看作各虚拟机的集合,再把其中的各虚拟机抽象为虚拟的文件系统(静态结构)和某IP地址上的网络服务(动态结构)的集合,论述其实现方法,构造出高效、低成本、逼真的诱骗环境。

The emergence of Intrusion Deception technology turns passive defense into active defense.The deception environment is the substitute for the real system,and is the core of the Intrusion Deception System. Through analyzing and researching the existing deception environment,we highly abstract it as a set of virtual machines,each virtual machine is abstracted as the combination of virtual file system and a series of network services,and describe the architecture and the key technology in implementing the deception environment. 