Abstract:In this paper, considering the problem that the common defensive means in the current cyber confrontation often fall into disadvantage, honeypot technology is adopted to turn reactive into proactive to deal with the increasingly serious cyberspace security problem. We address the issue of common defensive measures in current cyber confrontations that frequently lead to disadvantages. To tackle the progressively severe cyberspace security problem, we propose the adoption of honeypot technology to shift from a reactive to a proactive approach. This system uses honeypot technology for active defense, tempting attackers into a predetermined sandbox to observe the attacker's behavior and attack methods to better protect equipment and information security. During the research, it was found that due to the singularity of traditional honeypots and the limitations of low-interactivity honeypots, the application of honeypot technology has difficulty in achieving the desired protective effect. Therefore, the system adopts a highly interactive honeypot and a modular design idea to distinguish the honeypot environment from the central node of data processing, so that the honeypot can obtain more sufficient information and the honeypot technology can be used more easily. By managing honeypots at the central node, i.e., adding, deleting, and modifying honeypots and other operations, it is easy to maintain and upgrade the system, while reducing the difficulty of using honeypots. The high-interactivity honeypot technology not only attracts attackers into pre-set sandboxes to observe their behavior and attack methods, but also performs a variety of advanced functions, such as network threat analysis, virtualization, vulnerability perception, tracing reinforcement, and camouflage detection. We have conducted a large number of experimental comparisons and proven that our method has significant advantages compared to traditional honeypot technology and provides detailed data support. Our research provides new ideas and effective methods for network security protection.

A New Multi-Function System to Deal with Hacker Intrusion

Multi-agent based hybrid Intrusion detection system

Hybrid Intrusion Detection System for Complicated Network

Research and Implementation of Network Security Cooperative Defense System

Design and Implementation of Honeypot Scan Detection System

Research of a Hybrid Intrusion Detection System

An AI-Powered Network Threat Detection System

A Case Study: Using Architectural Features to Improve Sophisticated Denial-Of-Service Attack Detections

Effective allied network security system based on designed scheme with conditional legitimate probability against distributed network attacks and intrusions

Multi-agent Intrusion Detection System Based on Computer Immunity

Design and implementation of computer network security detection and control system

An intrusion-tolerant system based on neural network

A hybrid artificial immune system and Self Organising Map for network intrusion detection

A Highly Interactive Honeypot-Based Approach to Network Threat Management

Design on Combination System of Distributed Firewall and Invading Detection

Defending Distributed Systems Against Malicious Intrusions and Network Anomalies

An Intrusion Detection Framework Based on Hybrid Multi-Level Data Mining

Study and Implementation of a Distributed Virtual Honeynet System

A Dynamic Deceptive Honeynet System with A Hybrid of Virtual and Real Devices

A Computer Security System Based on Dynamic Hybrid Honeypot Technology

Honeypot and Scan Detection in Intrusion Detection System