Abstract:In this paper, considering the problem that the common defensive means in the current cyber confrontation often fall into disadvantage, honeypot technology is adopted to turn reactive into proactive to deal with the increasingly serious cyberspace security problem. We address the issue of common defensive measures in current cyber confrontations that frequently lead to disadvantages. To tackle the progressively severe cyberspace security problem, we propose the adoption of honeypot technology to shift from a reactive to a proactive approach. This system uses honeypot technology for active defense, tempting attackers into a predetermined sandbox to observe the attacker's behavior and attack methods to better protect equipment and information security. During the research, it was found that due to the singularity of traditional honeypots and the limitations of low-interactivity honeypots, the application of honeypot technology has difficulty in achieving the desired protective effect. Therefore, the system adopts a highly interactive honeypot and a modular design idea to distinguish the honeypot environment from the central node of data processing, so that the honeypot can obtain more sufficient information and the honeypot technology can be used more easily. By managing honeypots at the central node, i.e., adding, deleting, and modifying honeypots and other operations, it is easy to maintain and upgrade the system, while reducing the difficulty of using honeypots. The high-interactivity honeypot technology not only attracts attackers into pre-set sandboxes to observe their behavior and attack methods, but also performs a variety of advanced functions, such as network threat analysis, virtualization, vulnerability perception, tracing reinforcement, and camouflage detection. We have conducted a large number of experimental comparisons and proven that our method has significant advantages compared to traditional honeypot technology and provides detailed data support. Our research provides new ideas and effective methods for network security protection.

Characterizing Honeypot-Captured Cyber Attacks: Statistical Framework and Case Study.

Multiple Attacks Detection in Cyber-Physical Systems Using Random Finite Set Theory.

Statistical Techniques for Detecting Cyberattacks on Computer Networks Based on an Analysis of Abnormal Traffic Behavior

Spatiotemporal patterns and predictability of cyberattacks

Towards High Level Attack Scenario Graph Through Honeynet Data Correlation Analysis

Intelligent Threat Detection—AI-Driven Analysis of Honeypot Data to Counter Cyber Threats

Employing Honeynets For Network Situational Awareness

A Highly Interactive Honeypot-Based Approach to Network Threat Management

Measuring and Clustering Network Attackers using Medium-Interaction Honeypots

Characterizing Cyber Attacks against Space Systems with Missing Data: Framework and Case Study

Analysis of Honeypot Deployment

Constructing Dynamic Honeypot Using Machine Learning

Analysis of Attacker Behavior in Compromised Hosts During Command and Control

DDoSMiner: an Automated Framework for DDoS Attack Characterization and Vulnerability Mining.

A First Step Towards Understanding Real-world Attacks on IoT Devices

Attacker Profiling Through Analysis of Attack Patterns in Geographically Distributed Honeypots

What are Attackers after on IoT Devices? An approach based on a multi-phased multi-faceted IoT honeypot ecosystem and data clustering

Formal Description of Cyber Attacks

Towards Situational Awareness of Large-Scale Botnet Probing Events

Automating Analysis of Large-Scale Botnet Probing Events

Honeypot Method to Lure Attackers Without Holding Crypto-Assets