基于MySQL的蜜罐系统的构建

Construction of Honeypot System Based on MySQL

摘要: 随着网络安全威胁的不断演变，主动发现漏洞和潜在风险成为规避网络威胁的有力措施，但是传统杀毒软件和防火墙等均属于被动防御技术，使用蜜罐能够捕获攻击者信息，实现对网络威胁的主动防御。基于MySQL的蜜罐系统包括MySQL服务器模拟和数据可视化展示Web端，通过模拟MySQL通信伪造数据请求，吸引攻击者，实时捕获攻击者信息，并详细记录攻击日志进行可视化展示，Web端可以实现查看当前服务器所捕获的攻击次数、溯源个数、攻击IP和攻击地址等全部恶意攻击者信息的功能。使用本系统有效降低了运维人员应急响应和溯源的成本难度，为网络安全提供有力支持。

Abstract: As network security threats continue to evolve, proactive discovery of vulnerabilities and potential risks has become a powerful measure to avoid network threats. However, traditional anti-virus software and firewalls are passive defense technologies. The use of honeypots can capture attacker information and realize the active defense of network threats. The honeypot system based on MySQL includes MySQL server simulation and data visualization display Web side. It simulates MySQL communication and forges data requests to attract attackers, captures attacker information in real time, and records attack logs in detail for visual display. The Web side can view the current the function of all malicious attacker information such as the number of attacks, number of traces, attack IP and attack address captured by the server. The use of this system effectively reduces the cost and difficulty of emergency response and traceability for operation and maintenance personnel, and provides strong support for network security.