基于Linux共享库注射技术的网络诱骗系统设计  

Design of network deception system based on Linux shared library injection

作　　者：付治钧[1] 张建忠[1] 刘季坤[1] 

机构地区：[1]南开大学计算机科学与技术系,天津300071

出　　处：《计算机工程与设计》2007年第5期1020-1023,共4页Computer Engineering and Design

摘　　要：网络诱骗是一种主动的网络安全防御技术,通过跟踪、监视网络入侵者的行为来分析入侵者的攻击意图和行为特征,从而掌握最新的安全技术。其中,如何捕获入侵者的数据是实施网络诱骗的关键问题。分析了现有的网络诱骗系统的数据捕获方法的不足,并在深入研究Linux共享库注射技术的基础上,提出了一种以该技术为核心的网络诱骗数据捕获方法,使得诱骗系统更难于被发现,提高了诱骗的质量。并结合其它技术,给出了一个以该方法为核心的诱骗系统的实现。Network deception is an important technique for active security defense, which learns the intent and behavior of intruders by tracing and monitoring their activity. The key problem for network deception is how to collect the data of intruders. The implications of data capture methods of current deception systems are analyzed, then a new data capture method for network deception is proposed based on the shared library injection mechanism in Linux, which makes the deception system more difficult to discover, thus deception quality is improved. Based on this method, an implementation of network deception system combined with other techniques is presented.

关 键 词：共享库注射 动态链接 符号解析 网络诱骗 数据捕获 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]