基于网络/主机副本法的诱骗系统的研究与实现

分析比较了现有的网络诱骗技术及其优缺点,在采用网络/主机副本方案的基础上,提出了一种基于Limux动态进程共享库注射的数据捕获方法.系统主要分为诱骗客户端和服务器两个部分,客户端主要负责数据捕获和数据发送,服务器端将获得的数据存储并分类显示,显示方式包括命令行和图形界面.系统还采用了用户态-内核态通信、内核态发包、内核模块隐藏等技术.

Research and implement of network deception system based on network/host copy

Current network deception technologies are analyzed and compared. On the basis of adopting network/host copy scheme, a kind of data captured method based on Linux dynamic process shared library injection is proposed. This system is divided into deception client and server. The client is responsible for capturing and sending data; the server will store and display them either on command line or on graphic UI. This system also adopts some technologies such as communications between user space and kernel space, sending package from kernel mode, kernel module hiding, etc.