HoneyBow: 一个基于高交互式蜜罐技术的恶意代码自动捕获器

恶意代码已成为互联网最为严重的安全威胁之一，自动化捕获恶意代码样本是及时有效地应对恶意代码传播的必要前提，提出了一个基于高交互式蜜罐技术的恶意代码自动捕获器HoneyBow。相比较于基于低交互式蜜罐技术的Nepenthes恶意代码捕获器，HoneyBow具有恶意代码捕获类型更为全面、能够捕获未知恶意代码的优势，互联网上的实际恶意代码捕获记录对比和Mocbot蠕虫的应急响应处理实例对其进行了充分验证。

HoneyBow: an automated malware collection tool based on the high-interaction honeypot principle

Malware has become one of the severest threats to the public Internet. To deal with the malware breakout effectively as early as possible, an automated malware collection solution must be implemented as a precondition. An automated malware collection tool was presented based on the high-interaction honeypot principle called HoneyBow. Comparing with the Nepenthes platform based on the low-interaction honeypot principle, HoneyBow has its advantages on wilder range of captured malware samples and the capability of collecting unknown malware samples, which are vali- dated by the experiment results from wild malware collection and the case of Mocbot dealment.