The Research on Network Function Virtualization Based Network Honeypot

Abstract

Honeypot technology is a trap technology in network defense, which protects real service resources by attracting and luring attackers and recording their attack behaviors, so as to study and learn the attack purpose and attack means of adversaries. Traditional honeypot technology has inherent deficiencies such as static configuration and fixed deployment, which are easily identified and bypassed by attackers and lose their decoy value. In order to further improve the decoying capability of honeypot system while reducing the cost of deploying honeypot system. In this paper, the network honeypot system design is based on the approach of network device virtualization. The framework structure of the virtualized router module is designed, including the design of the virtualized router, virtual router operating system and Vnsp_VBox Server, and the workflow and module functions of Vnsp_VBox Server are designed and implemented. The focus is on implementing the various modules and functions of the virtualization router, and completing the management of virtual machines by calling the VirtualBox API interface. Finally, we tested the functions of the virtualization router, including the creation and switching of the virtualization router, as well as the network communication of the virtualization router through network communication protocols, such as TCP/IP protocol and DHCP protocol.