基于无硬盘Honeypot的入侵防御系统  

Intrusion Prevention System Based on Diskless Honeypot

作　　者：叶禾田 蔡昀璋 

机构地区：[1]南台科技大学信息传播研究所,台湾台南71005

出　　处：《上海交通大学学报》2012年第2期289-295,共7页Journal of Shanghai Jiaotong University

基　　金："国家科学委员会"资助(99-2221-E-218-037-)

摘　　要：通过DRBL(Diskless Remote Boot in Linux)建立无硬盘环境的诱捕系统(Honeypot sys-tem),并融合入侵防御系统优越的入侵检测与防御能力,使入侵防御系统不仅能检测恶意活动也具备诱捕功能.当检测出恶意行为时及时警告网络管理人员,并立即将恶意行为引导至Honeypot,由与恶意行为互动的过程,详细纪录其活动行为、入侵方法、入侵管道,以供网管人员日后进行系统修补更新时参考,可大幅减少系统漏洞和大幅提升系统安全性.The plan is mainly based on DRBL（Diskless Remote Boot in Linux） to establish diskless Honeypot system and integrate intrusion prevention system（IPS） superior invasion examination and defense capability.It enables the IPS system not only to examine the malicious activity also to entrap the malicious attack.When examining the malicious act,it can warn network administrator immediately and guide the malicious act to Honeypot.By the interaction with malicious act,it can record its behavior,the invasion method and channel,provide the network administrator renewal to patch the system,reduce the system loophole and promote security largely.

关 键 词：无硬盘远程开机系统 诱捕系统 入侵防御系统 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]