基于系统和网络特征的蜜罐识别技术  

Anti-Honeypot based on system and network characteristic

作　　者：袁新海[1] 陈家琪[1] 

机构地区：[1]上海理工大学计算机工程学院,上海200093

出　　处：《计算机工程与设计》2008年第7期1622-1624,1772,共4页Computer Engineering and Design

基　　金：上海市教育委员会科研基金项目(04EB12)

摘　　要：蜜罐是一个在网络上监视和跟踪非法入侵者的系统,通常认为蜜罐是很难识别的。为了进一步推动蜜罐的发展,讨论了当前的基于系统特征的蜜罐的识别技术,在前人的基础上进一步提出了基于网络特征的新的蜜罐识别技术,即根据目标机提供的服务和请求回显时间来判断目标机是真实的主机还是蜜罐,并用这些技术做了实验,验证了这些技术在实际应用中的可行性。Honeypot are deployed on networks to detect and monitor misuse of computer and network resources by unauthorized individuals, and it is usually assumed that Honeypots are hard to detect. For the sake of improving the development ofhoneypot, the current anti-honeypot is discussed based on system characteristic, on the foundation of senior people the anti-honeypot based on the network features is put forward, namely according to the service provided by the goal machine and the time echo requests to judge the goal machine is the real machine or honeypot, and the experiment of these technologies confirmed these technologies are feasible in the practical application.

关 键 词：蜜罐 蜜罐识别技术 数据捕获 数据控制 隐藏 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]