The Wayback Machine - http://web.archive.org/web/20201118111952/https://github.com/hacklcx/HFish/issues/102
Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

推荐提供类似默安的幻阵的tcp代理蜜罐功能,这样agent 的负载会更小,也能复用更多开源蜜罐 #102

Open
wcc526 opened this issue Jun 4, 2020 · 0 comments

Comments

@wcc526
Copy link

@wcc526 wcc526 commented Jun 4, 2020

推荐提供类似默安的幻阵的tcp代理蜜罐功能,这样agent 的负载会更小,也能复用更多开源蜜罐

https://www.moresec.cn/solution-deception.html
https://www.moresec.cn/news/51

各商业公司通过更为细化的模拟手段,将原有蜜罐的模拟层面从终端系统层下放至应用层面,即可以模拟各类常见应用使得攻击者能够进入此类应用进行基本控制操作,深化了蜜罐交互仿真度;同时针对部署密度和成本问题,增设了探针,蜜罐不再是直接实机部署在真实业务,而是通过在真实环境部署探针降低单点部署成本,增加部署密度,并将探针与后台蜜罐关联,实现对攻击的感知。

基于上述两点优化思想,各商业公司提供了现今我们市面上看到的种类繁多的商业化蜜罐方案,总结来看此类方案可以归纳成两类:探针导向式和流量牵引式。

探针导向式即如我们所述,通过在真实业务中部署探针降低单点部署成本,同时通过模拟应用提升仿真度,当攻击者攻击探针时,探针将进行转发,从而将攻击者带入蜜罐的模拟应用中,从而第一时间感知攻击者行为并进行告警。

流量牵引式其实与探针导向式类似,只是其将探针的导向能力交给了流量牵引器,牵引器前端关联探针,后端关联蜜罐,一旦探针受到攻击,流量牵引器会更改其流量方向,将攻击牵引至蜜罐中,从而实现对攻击者的感知和尝试驻留。

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
1 participant
You can’t perform that action at this time.