自定义蜜罐在抵御蠕虫攻击中的应用研究

全文分析了蠕虫病毒的危害和特征,提出一种自定义蜜罐系统的设计:结合入侵检测、虚拟蜜罐和数据挖掘技术,把自定义蜜罐置于DMZ中,利用欺骗地址空间技术捕获已知蠕虫,延缓未知蠕虫的扫描速度,并对相关日志进行数据挖掘,更新入侵检测系统的规则集,以便在遭受后续攻击时做出响应。探讨了自定义蜜罐系统在抵御蠕虫病毒攻击中的可行性和应用实现。

Custom honeypot in the research on the application of attack against the worm

Full text analyzes the characteristics and harm of worm virus,and put forward a kind of custom honeypot system design:according to the intrusion detection,virtual honeypot and data mining technology,put the custom honeypot into the DMZ,using guile address space technology capture known worms,delay the unknown worms scanning speed,and analyzes the log by data mining,update the intrusion detection system rules set,and make timely response and take measures in the subsequent attack.Discusses the custom honeypot system against the worm virus attack in the feasibility and the application implementation.