Honeypot及其安全增强技术研究

蜜罐(Honeypot)是一种主动防御的网络安全技术,可以吸引入侵者的攻击,保护工作网络免于攻击,而且能监视和跟踪入侵者的行为并以日志形式记录下来进行分析,从而学习入侵者的工具、策略和方法.文中介绍了蜜罐技术的基本理论,分析了蜜罐系统的工作原理,设计了一种基于主机的蜜罐系统,讨论了其基本结构和工作流程,然后着重分析了系统可能面临的安全威胁与防御对策,并在总体上给出了系统的安全增强方案.

A Study on Honeypot and its Security Enhancement Technology

Honeypot is a network security technology of active defense, which can attract attackers and protect operating network from attack. It can monitor and track attacker, record the information in form of log so that it can be analyzed and then the tools, tactics and method of the intruder are learned. The basic theory of honeypot is introduced, and its working principle is analyzed, then a honeypot system based on host is designed, and its architecture is discussed. The security threat and defense tactics of the system is carefully analyzed, and method to enhance system security is presented.