基于Apache的低交互蜜罐设计与实现  

Design and Implementation of a Low-interaction Honeypot Based on Apache

作　　者：吴馨[1] 黄皓[1] 

机构地区：[1]南京大学计算机科学与技术系软件新技术国家重点实验室,南京210093

出　　处：《计算机科学》2006年第4期97-102,共6页Computer Science

基　　金：国家863项目"分布式网络监控与预警系统"(2003AA142010);江苏省高技术研究项目"计算机网络分布式主动协同防御与战略预警"(BG2004030)的资助

摘　　要：蜜罐是一种新型的网络防御工具,其伪装的逼真程度和欺骗的成功率一直是设计的难点。很多蜜罐通过脚本来模拟网络服务,使用静态欺骗来保护网络,很容易暴露。本文设计并实现了一种基于 Apache 的低交互蜜罐——Honeyweb.具有 http 协议检测、动态欺骗、与其他网络安全设备联动以及日志等功能,能根据不同的 http 请求作出动态欺骗响应。实验表明,部署它能在很大程度上影响黑客的判断力,消耗攻击资源,甚至阻止攻击,从而实现主动防御、保护 Web 服务器免受攻击的目的。Honeypot is a new tool for network defence. The difficulty of designing a Honeypot lies in the success disguise and deception. Many Honeypots use scripts to simulate services, and put static deception into practice to protect network. But they could expose themselves easily, This paper designs and implements a low-interaction Honeypot based on the Apache server, named Honeyweb. It has four functions： http protocol detection, dynamic deception, working with other network security devices and log. It can dynamicly response to different http requests. The exprimerit indicates that depolying the Honeyweb will influence hackers＇ judgement, consume their resources, even stop attack. So Honeyweb can reach its purpose of active defenee and preventing Web servers from attack.

关 键 词：蜜罐 蜜网 欺骗 主动防御 

分 类 号：TP393.4[自动化与计算机技术—计算机应用技术] TP393.08[自动化与计算机技术—计算机科学与技术]