Active Defense Security Model in the Application of Network Deception System Design

Abstract:

As the traditional network defense is built on intrusion detection and passive protection, which is weak at dynamic response. The network deception technology in active protection is analyzed, and a network deception system based on active security model is proposed in this paper. This system implements a visual service of Honeypot as bait, analyses intrusion data and extracts new features and rules to enlarge the intrusion detection system feature library. The defense policies could be delivered real-time by management center. The problems of false alarm and leaking alarm for firewall or IDS are improved. And the limitations of single technology on the cooperation are overcome by linkage of Honeypot, firewall, IDS and router. The efficiency of unknown intrusion detected is increased.

• Periodical: Applied Mechanics and Materials (Volumes 347-350)
• Pages: 2860-2864
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.347-350.2860
• Online since: August 2013
• Authors: Jia Wei Du, Xing Zhang, Ying Zhou, Yong Qiang Bai
• Keywords: Active Defense, Honeypot, Linkage, Network Deception, Security Model

References

[1] Zhao Hongjing, Zhou Chuangming, Zhai Pingli, Yu huan, Zhao Mingli, Inrusion Deception System based on network active defense security model, Airforce Engineering University Journal, 2010. 6.

[2] Zhao Linlin, Yan Ruoyu, Li Qisheng, Network security active cooperative defense system framework based on P2DER model, Practice and experience, 2007, 6.

[3] Zhai Guangqun, Chen Xiangdong, Hu Guijiang, Research and design on honeypot and IDS linked system, Computer engineering and design, 2009, 30(21).

[4] Han Ruisheng, Chu Kaiyong, Zhao bing, Research and design in P2DR of policy deployment model[J], Computer Engineering, 2008(10).

[5] Wang Tiefang, Li Yunwen, Ye Baosheng, A network security defense technology based on honeynet[J], Comuputer Application Research, 2009, 26(8).

DOI: 10.1109/icent.2010.5532096

[6] Babak Khosravifar, Jamal Bentahar. An experience improving intrusion detection systems false alarm ratio by using Honeypot[C]. 22nd International Conference on Advanced Information Networking and Applications, (2008).

DOI: 10.1109/aina.2008.44

[7] Provos N. A Virtual Honeypot Framework [EB/OL]·[2004-12-29] (2009-10-30)· http: /www. usenix. org/event/sec04/tech/full - papers/provos/provos-htm. l.

[8] Peng Zhao, Research and Realization based on linked network intrusion defense system[Thesis], Beijing University of Posts and Telecommunications, 2010. 12.

[9] http: /www. cert. org. cn.

[10] Zou Ruiyuan, Research and application survey on honeypot techonology[J], Computer security, 2010. 56.