基于行为分析和环境评估的蜜罐检测方法  

A Honeypot Detection Method based on Behavior Analysis and Environment Evaluation

作　　者：邓文达[1] 夏一民 董春丽[3] 

机构地区：[1]长沙民政职业技术学院 [2]福州市95813部队一处 [3]解放军信息工程大学

出　　处：《微计算机信息》2010年第15期100-102,共3页Control & Automation

摘　　要：蜜罐可以监视和记录攻击者的行为,帮助安全人员掌握攻击者使用的方法和工具,是信息安全中主动防御技术之一。本文提出一个蜜罐检测模型,并针对高交互蜜罐系统,提出一种基于网络监控行为分析和虚拟环境检测的蜜罐发现技术。首先,从被攻陷主机向另一台主机发出攻击性报文,并且根据该主机能否正常发送出攻击性报文来确定被攻陷主机是否是蜜罐系统。然后,通过读取被攻陷主机的设备信息和硬件配置情况,判断该主机是否是虚拟主机,进而判断当前系统是否是一个蜜罐。Honeypot is a typical technology of active defense.It can be used to monitor and record the behavior of the attackers.This paper proposes a new model to detect honeypot,and introduces a detection method to detect high-interactive honeypot system which is based on behavior analysis and environment evaluation.First,some attack messages are dispatched from a captured host,and consider the host is a honeypot host if the dispatch is anomaly,second,judge the captured host is running on a real host or a virtual host with its system information and hardware configuration,and consider it is a honeypot if it is running on a virtual host with some service provided.

关 键 词：蜜罐 行为分析 环境评估 高交互 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]