排序方式: 共有35条查询结果,搜索用时 0 毫秒
1.
基于蜜罐技术的计算机动态取证系统研究 总被引:1,自引:1,他引:0
提出了一种基于蜜罐的计算机动态取证方法.该方法通过蜜罐技术将入侵转移到一个虚拟的环境,不仅可以保护网络或主机不受攻击,而且还可以为证据的提取争取到更长的时间,从而获得更为真实的电子证据.实验结果表明:基于蜜罐的动态取证系统具有检测率高、误报率低、取证能力强的特性. 相似文献
2.
3.
SSH是相对于传统协议而言安全可靠的远程服务协议,然而现今针对于SSH的暴力破解攻击已经严重威胁了其安全性.为了研究SSH暴力破解攻击行为特征,提高系统和服务的安全性,采取了不同于传统网络防护的被动防御策略,搭建了基于Kippo蜜罐的主动防御系统,并基于此,利用Kippo蜜罐的日志记录,对攻击者及其攻击行为特征进行了多方面的详细分析,从而提出了SSH服务的安全建议与加固措施,在一定程度上增强了针对SSH暴力破解攻击的防御能力,提高了安全性. 相似文献
4.
A Novel Approach for Redirecting Module in Honeypot Systems 总被引:3,自引:3,他引:0
YANG Geng~ RONG Chun-ming~ PENG Lei~.Department of Computer Science Technology Nanjing University of Posts Telecommunications Nanjing P.R. China .Department of Electrical Computer Engineering Stavanger University P.O.Box N- NORWAY 《中国邮电高校学报(英文版)》2005,12(3)
1 Introduction Computer network security has been focus on passivedefense strategies usingtools and conceptslike Firewall ,Intrusion Detection System(IDS)[1 ~3]. This is an un-reasonable situation,because users have to protect com-puter systems perfectly, while hackers can use one ofvulnerabilities to attackthe systems . We are alwaysin apassive position.The bad guys have theinitiative .Theyhave unli mited resources and attack you whenever theywant , however they want . Moreover ,in a trad… 相似文献
5.
6.
Wen Tian Xiao‐Peng Ji Weiwei Liu Jiangtao Zhai Guangjie Liu Yuewei Dai Shuhua Huang 《ETRI Journal》2019,41(5):585-598
A cyber‐physical system (CPS) is a new mechanism controlled or monitored by computer algorithms that intertwine physical and software components. Advanced persistent threats (APTs) represent stealthy, powerful, and well‐funded attacks against CPSs; they integrate physical processes and have recently become an active research area. Existing offensive and defensive processes for APTs in CPSs are usually modeled by incomplete information game theory. However, honeypots, which are effective security vulnerability defense mechanisms, have not been widely adopted or modeled for defense against APT attacks in CPSs. In this study, a honeypot game‐theoretical model considering both low‐ and high‐interaction modes is used to investigate the offensive and defensive interactions, so that defensive strategies against APTs can be optimized. In this model, human analysis and honeypot allocation costs are introduced as limited resources. We prove the existence of Bayesian Nash equilibrium strategies and obtain the optimal defensive strategy under limited resources. Finally, numerical simulations demonstrate that the proposed method is effective in obtaining the optimal defensive effect. 相似文献
7.
8.
蜜罐技术是一种欺骗入侵者以达到采集黑客攻击方法和保护真实主机目标的诱骗技术,它的核心价值在于被探测、被攻击或者被威胁,以此达到对这些攻击活动的检测与分析,从而了解攻击者的目的、攻击手段甚至于心理习惯,最终实现从观察攻击者的行为中学习到深层次的信息保护的方法。在蜜罐技术的应用过程中,最为关键的一点就是蜜罐系统对攻击者所具有的迷惑性。从蜜罐系统特有的系统特征、硬件特征以及网络特征出发,分析各种蜜罐系统或者虚拟机系统中可能存在的一些可识别的特性,提出一些识别方案并针对部分方法进行了编程识别,希望能够引起安全行业的重视,能够推动蜜罐技术的发展。 相似文献
9.
HoneyBow: 一个基于高交互式蜜罐技术的恶意代码自动捕获器 总被引:12,自引:0,他引:12
恶意代码已成为互联网最为严重的安全威胁之一,自动化捕获恶意代码样本是及时有效地应对恶意代码传播的必要前提,提出了一个基于高交互式蜜罐技术的恶意代码自动捕获器HoneyBow。相比较于基于低交互式蜜罐技术的Nepenthes恶意代码捕获器,HoneyBow具有恶意代码捕获类型更为全面、能够捕获未知恶意代码的优势,互联网上的实际恶意代码捕获记录对比和Mocbot蠕虫的应急响应处理实例对其进行了充分验证。 相似文献
10.
针对当前互联网客户端攻击频发的态势,首先阐述了基于本地程序漏洞的客户端攻击概念,着重讲解了网站挂马攻击的特征。其次阐明了客户端蜜罐系统的基本原理,并介绍了一种高效的客户端蜜罐系统HoneyClient。随后通过对网站挂马攻击的特征分析提出了使用HoneyClient对其进行有效检测的方案,并对该方案进行了事实验证。最后通过对实验结果的分析与总结,提出了对网页木马型客户端攻击进行检测的改进策略和展望。 相似文献