【摘要】 针对当前防火墙和入侵检测系统不能够对未知攻击作出有效的判断,而造成信息误报和漏报的问题,提出了一种蜜罐系统结构,通过过滤掉已知攻击,在系统调用层,采用攻击签名机制,实现对未知攻击的检测和分析。更多还原

【Abstract】 The current firewall and intrusion detection system cannot effectively discern the unknown attacks, so it leads to false positives and negatives for the information. Therefore, a kind of honeypot system was proposed,by attack signature mechanism for detecting and analyzing unknown network attacks in system call level.更多还原