Honeypot-based Network Intrusion Detection System

Distributed Denial of Service (DDoS) attacks against Internet security is one of the attacks that most harm and difficult to prevent. While the research for defending against DDoS attacks be took in a wide range, since DDoS attacks' means uniqueness, the current methods are not fundamentally to defending against such attacks. This paper analysis of the DDoS attack principles and the current methods used to defending against the DDoS, and summed up its shortcomings also; This paper has also analyzed the shortcoming of current model, which based on honeypot technology. For improve these short comings, this paper designed and implemented a model based on honeypot technology to defending against DDoS. Honeypot technology is a new technology for network security; Its main role is to confuse hackers and records attacks. This model using honeypot sub-network to receive attacks flow that switching from server, it can protect host server and confuse hackers, also can records hackers information in detail. Log information for analysis and evidence of attack is very important, In order to ensure the security and credible of honyepot systems collected log information, this paper also designed and realized a program to store log information in a long-distance server. This model adopts the way of judging then transmitting the attacks flows to the honeypot, have protected the server and guaranteed the normal access of the important customer at the same time .The model that this paper puts forward has the following advantages: Use the distance server to store the log information that the honeypot system collects the attacking, protect the security of the information of the log and can be believed.Concrete design and realization of the model system in detail describe in this paper , including the frame of the model, honeypot function in the model, the function analysis of the model prevent against DDoS attacking, realization of the redirection technology of the attacking flows, the realization and design of the distance log storing system etc.