Design And Implementation Of Dynamic Hybrid Honeypot Network

Facing up the complex and changeful attack, proposed a method which builda dynamic hybrid honeypot network, used virtual honeypot and network scanningtechnology, synthesize the advantages both low and high interaction honeypot, toconfuse attacker, delay and transfer of attack, consume attack resources, protectthe actual network environment, and collect informations.First we introduced the basic concepts of honeypot technology and virtualhoneypot framework Honeyd, analysed all kinds of network scanning techniqueswhich used by the system detailedly, especially the active protocol stackfingerprinting technique, then designed and implemented the hybrid virtualnetwork system.The hybrid virtual network architecture used Honeyd for a virtual honeypot,Virtualbox as virtual software, and honeynet gateways to deploy virtual honeynetroo. The system collect and study real network environment dynamically, andthen configure a virtual network which similar to real network topologyaccording to the collected informations. Virtual network plays an important rolein our analysis and research to the hacker’s attack, especially about the confusedhacker attacks and investigate behavior process. We test the system useappropriate allocation strategy, the results show that the design can imitatedvirtual network environment successfully. The Nessus testing is used to imitateattacks of the system, and verify the overall performance. The data play aimportant role for administrators. Finally, we statistics and analysis the highinteraction honeypot information in detail, to prove the value of the system forcapture the important information.