蜜罐技术研究与应用进展

发布时间：2018-05-11 09:52

本文选题：网络安全 + 蜜罐　；参考：《软件学报》2013年04期

【摘要】：蜜罐是防御方为了改变网络攻防博弈不对称局面而引入的一种主动防御技术,通过部署没有业务用途的安全资源,诱骗攻击者对其进行非法使用,从而对攻击行为进行捕获和分析,了解攻击工具与方法,推测攻击意图和动机.蜜罐技术赢得了安全社区的持续关注,得到了长足发展与广泛应用,并已成为互联网安全威胁监测与分析的一种主要技术手段.介绍了蜜罐技术的起源与发展演化过程,全面分析了蜜罐技术关键机制的研究现状,回顾了蜜罐部署结构的发展过程,并归纳总结了蜜罐技术在互联网安全威胁监测、分析与防范等方向上的最新应用成果.最后,对蜜罐技术存在的问题、发展趋势与进一步研究方向进行了讨论.
[Abstract]:Honeypot is an active defense technology introduced by the defense side in order to change the asymmetric situation of the network attack and defense game. By deploying the security resources that have no business purpose, the honeypot can trick the attacker into using it illegally. So the attack behavior is captured and analyzed, the attack tools and methods are understood, and the intention and motive of the attack are speculated. Honeypot technology has won the continuous attention of the security community and has been developed rapidly and widely used, and has become a major technical means for monitoring and analyzing Internet security threats. This paper introduces the origin and evolution of honeypot technology, analyzes the research status of the key mechanism of honeypot technology, reviews the development process of honeypot deployment structure, and summarizes the honeypot technology in the monitoring of Internet security threats. The latest application results in the direction of analysis and prevention. Finally, the problems, development trend and further research direction of honeypot technology are discussed.
【作者单位】：清华信息科学与技术国家实验室(清华大学);清华大学网络科学与网络空间研究院;国防科学技术大学计算机学院;北京大学计算机科学技术研究所;
【基金】：国家自然科学基金(61003127,61003303) 国家重点基础研究发展计划(973)(2009CB320505) 国家242信息安全计划(2011A40)
【分类号】：TP393.08

【参考文献】