利用IP分片技术探测Honeyd虚拟蜜罐  

HONEYD-BASED HONEYPOT DETECTION WITH IP PACKET FRAGMENT

作　　者：翟继强[1] 乔佩利[1] 

机构地区：[1]哈尔滨理工大学计算机科学与技术学院,黑龙江哈尔滨150080

出　　处：《计算机应用与软件》2009年第4期44-46,共3页Computer Applications and Software

基　　金：国家科学与技术部社会公益研究专项基金项目(DIB2J218)

摘　　要：分析了作为主动安全技术而广泛使用的虚拟蜜罐框架Honeyd的IP分片重组技术的漏洞,并编写了一个概念性探测软件来验证这个安全漏洞。测试表明利用该漏洞可以有效地侦测出基于Honeyd的虚拟蜜罐的存在和布置范围,进而提出了相应的弥补漏洞的办法。In this paper we analyze a serious vulnerability in IP fragment and reassembly procedure in Honeyd that is a virtual honey pot framework most commonly used as the new active network security technology. Then a proof-of-concept tool is developed to test this vnlnerability. Verification experiments show that this tool is extremely accurate and effective in detection of the presence of Honeyd and its deployment scope through the vulnerability, and a simple fixing approach for this flaw is further discussed.

关 键 词：蜜罐 HONEYD 漏洞 IP分片 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术] Q784[自动化与计算机技术—计算机科学与技术]