HONEYD解析  

Research of HONEYD

作　　者：江森林[1] 张基温[1] 严俊[1] 

机构地区：[1]江南大学信息工程学院,江苏无锡214036

出　　处：《计算机工程与设计》2005年第3期682-685,共4页Computer Engineering and Design

摘　　要：针对HONEYD的特色——能在一台物理机器上创建大量的虚拟蜜罐,从逻辑结构上、对不同网络数据包的处理上、通过脚本语言的实现上分析了如何创建虚拟蜜罐。虚拟蜜罐需要很好地伪装,深入地分析了HONEYD 的伪装技术——指纹匹配技术和网络拓扑虚拟技术。最后指出了HONEYD 还存在的缺点及改进思路。According to the characteristics honeyd has that it allows to create large amounts of virtual honeypots on a physical host, the analysis of how to simulate virtual honeypots with honeyd from different sides such as logical structure and the way that honeyd deals with different packets and the achievements of those supplied scripts are completed. To convince the bad guys that the system is almost a real one, so many works should be done to disguise it. The relative technologies include fingerprinting-matching technology and simulating technology of routing topology. And in the end, some of the defects from honeyd and some modification of them are pointed out.

关 键 词：蜜罐 网络数据包 指纹匹配 脚本语言 虚拟技术 网络拓扑 创建 物理 特色 改进思路 

分 类 号：TP393[自动化与计算机技术—计算机应用技术] TP391[自动化与计算机技术—计算机科学与技术]