CN103561004A - Cooperative type active defense system based on honey nets - Google Patents

Abstract

The invention provides a cooperative type active defense system based on honey nets. The cooperative type active defense system comprises a data capture module, a data analysis module and a data control module and is characterized in that the data capture module, the data analysis module and the data control module are arranged at the center of one honey net and a plurality of sub nets in a distributed mode. The cooperative type active defense system depends on a honey net technology, a cooperative type active defense thought is adopted, attacker information captured by the different honey nets is shared in real time, active defensiveness of a network layer is achieved, defensive initiative and real-time performance are improved, and the cooperative type active defense system is suitable for large-scale enterprise networks. The cooperative type active defense system built through the method is high in defense rate, hit rate and robustness, and time delay from the time that attackers are firstly found to the time that all network deployment and control is achieved is greatly reduced.

Description

Cooperative Active Defense System Based on Honeynet

technical field

The invention relates to the field of network security, in particular to a honeynet-based cooperative active defense system.

Background technique

With the development of the Internet, network security is facing more and more serious threats. Several major current network security threats: Trojan horses, worms, botnets, network interception, IPv6 threats, spyware and adware, zero-day vulnerabilities, and DDoS (distributed denial of service) attacks. Effective defense against network security threats has become a top priority.

The types of network security defense can be divided into host-based and network-based defenses according to different defense positions; they can be divided into passive defense and active defense according to different defense timing. The traditional passive defense method based on the host layer has been difficult to protect the security of the existing network, so the concept of active defense has emerged, which usually refers to the user characteristics independently discovered through the program, so that the attacker cannot complete the attack on the target.

The representative of active defense is the Intrusion Detection System (IDS), which monitors the operating status of the network and the system according to a certain security policy, and discovers various attack attempts, attack behaviors or attack results as much as possible, so as to ensure the security of the network. The confidentiality, integrity and availability of system resources, its real-time and initiative are beyond the reach of traditional security measures, and it also makes up for the shortcomings of passive defense systems that cannot protect unknown types of attacks. However, there are still defects in the traditional intrusion detection system. Because the amount of information to be processed by intrusion detection is very large, the quality of the attack behavior classification model will directly affect the efficiency of detection. It is a huge knowledge project to build an effective intrusion detection system. Since the development process is manual, the scalability and adaptability of the current intrusion detection system are limited. The intrusion detection model in practical application can only deal with a special audit data source, and the update cost is high and the speed is slow.

In order to overcome the limitations of traditional intrusion detection systems, a more automatic and efficient mechanism should be adopted, and Honeypot is such a system. Lance Spitzner, founder of The Honeynet Project, gave an authoritative definition of honeypots: a honeypot is a security resource whose value lies in being scanned, attacked and compromised. All network traffic to and from a honeypot may indicate scanning, attacks, and compromises. According to the purpose of deployment, honeypots can be divided into two types: product honeypots and research honeypots. Honeypots can be divided into low-interaction honeypots and high-interaction honeypots according to their level of interaction. The advantages of honeypot technology include: the fidelity of collected data is high, new attack tools and attack methods can be collected, it does not require strong resource support and capital investment, and it is relatively easy to master.

A honeynet includes one or more honeypots, which can provide a variety of tools to facilitate the collection and analysis of attack information while ensuring a high degree of controllability of the network. The use of honeynet can effectively change the information asymmetry between the defender and the attacker. At present, the high-interaction honeynet is mainly used for the extraction, analysis and research of data attack data, mainly to manually analyze the massive data extracted by the honeynet, and to discover the attacker's attack strategy, attack code and attack location and other related information. Although the purpose of defense can be achieved in the end, it is a passive defense that requires a lot of manual participation and has serious lag, making it difficult to systematize and productize.

Contents of the invention

Aiming at the deficiencies of the prior art, the purpose of the present invention is to propose a honeynet-based cooperative active defense system, which relies on the honeynet technology, adopts the cooperative defense idea, can realize active defense at the network layer, and is suitable for large-scale enterprise network.

In order to realize the above object of the invention, the present invention adopts the following technical solutions:

A honeynet-based cooperative active defense system, including a data capture module, a data analysis module and a data control module, is characterized in that:

The data capture module, data analysis module and data control module are distributed in a honeynet center and multiple subnets, wherein,

The data capture module includes a global log record database located at the honeynet center and a honey wall in each subnet, a plurality of honeypot hosts, a remote log record server, and an intrusion detection server;

The data analysis module includes a statistical server located at the center of the honeynet, an attack pattern extraction server, a global malicious code analysis server, a comprehensive computing server, a global visualization server, a global statistical database and a global feature database, and local online data in each subnet analysis server;

The data control module includes a global control server located at the center of the honeynet, a global control database and a global intrusion behavior rule database, as well as redirectable routers and firewalls in each subnet.

The present invention has the following beneficial effects:

1. The combination of honeynet technology and active defense technology improves the hysteresis of traditional honeynet technology passive defense, reduces the workload of manual analysis, and improves the real-time and accuracy of defense.

2. The coordinated defense between multiple subnets makes up for the shortcomings of a single subnet such as small scale, simple structure, and single information, and further improves the initiative and real-time performance of defense.

3. Using a simple and efficient data analysis algorithm, the defense strategy formulated has a high defense rate, hit rate and very low leakage prevention rate and hit rate.

4. The data collected by the honeynet has high reliability and controllability, and low cost. There is no need for users to report, it will not affect the normal communication of users, and it will not leak user privacy.

5. The defense is implemented at the network layer, which reduces the load on the firewall and the burden on the user's host using anti-virus software based on the host layer.

6. The deception module increases the robustness of the system.

Description of drawings

Figure 1 is a frame diagram of the main modules of the autonomous defense subsystem based on the honeynet

Figure 2 is a network deployment diagram of the autonomous defense subsystem based on the honeynet

Figure 3 is a frame diagram of the main modules of the honeynet-based cooperative active defense system

Figure 4 is a network deployment diagram of a cooperative active defense system based on honeynet

Figure 5 is a block diagram of the honeynet-based autonomous defense subsystem with the deception module added

Detailed ways

In order to make the object, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings and exemplary embodiments. It should be understood that the exemplary embodiments described here are only used to explain the present invention, and are not intended to limit the applicable scope of the present invention.

Before introducing the cooperative active defense system of the present invention, it is first necessary to explain the working mechanism of the honeynet-based autonomous defense subsystem. The enterprise network can be divided into multiple subnets, generally divided according to each network segment in the C class network, and divided according to the subnet mask in the A and B class networks. The autonomous honeynet-based defense subsystem is arranged within a single subnet, which has three main modules and one additional module. As shown in Figures 1 and 5, the three main modules are the data capture module, the data analysis module and the data control module, and the additional module is the intrusion deception module.

The autonomous defense subsystem based on the honeynet is deployed in a single subnet, that is, the honeynet and the user network are located in the same network segment, as shown in Figure 2, in which not only the main hardware is marked, but also the module distribution and Data flow direction. Wherein, the data capturing module includes a honeywall, multiple honeypot hosts, a remote log recording server, a log recording database and an intrusion detection server. The data analysis module includes an offline data analysis server, an online data analysis server, a visualization server, a malicious code analysis server, a statistics database and a feature database. The data control module includes control server, control database, router, honey wall, firewall and intrusion behavior rule database.

1. Data capture module

The data capture module belongs to the input module, including honey wall, multiple honeypot hosts, remote logging server, logging database and intrusion detection server.

(1) Honey Wall (Honey Network Gateway)

The honeynet can be arranged outside, inside or in the DMZ (Demilitarized Zone) of the firewall, and is usually arranged in the DMZ of the user network and the external network, that is, the area between the trusted user internal network and the untrusted external network. For the user network, the honeynet is a dangerous area, because the honeypot is a very vulnerable host, once the attacker uses the honeypot as a springboard to launch an attack on the user network, the active defense system will not be worth the candle. The honey wall is the only barrier between the honey network and the user network. The honey wall includes three network interfaces, eth0 is connected to the external network, eth1 is connected to the honeynet, and eth2 is used as a secret channel to connect to a monitoring network. Honeywall is a link layer bridging device that is invisible to hackers. As the only connection point between the honeynet and other networks, all network traffic flowing into and out of the honeynet will pass through the honeywall and be controlled and audited by it. At the same time, because the Honeywall is a bridging device working at the link layer, it will not perform TTL decrement and network routing on network packets, and will not provide its own MAC address. Therefore, for attackers, the Honeywall is completely useless. visible.

(2) Honeypot host

The malicious code capture program running at the ring0 level is installed on the three honeypot hosts. Since it runs at the ring0 level, it is not easy to be discovered by the attacker. It can automatically or manually pass the malicious code on the attacked honeypot host through the secret channel Transfer to malicious code analysis server. A sandbox (sandbox) program runs in the virtual machine of the server, and malicious codes are analyzed in the sandbox, and the analysis results can be applied to the data control module. All honeypot hosts need to be maintained after a period of time.

(3) Client honeypot tools

In order to increase the initiative of the honeynet, some honeypots can run client-side honeypot tools with web crawler functions, such as capture-HPC, which can automatically search for malicious servers, detect webpage Trojans, and strengthen data Capturing the function of the module.

(4) Remote logging server and logging database

The remote logging server is responsible for storing the data transmitted by the honeynet in the logging database in real time, and periodically transmitting the data in the logging database to the data analysis module.

(5) Intrusion detection server

Considering that the attacker may invade the user network directly or first, in order to increase the robustness of the system, the honeynet is combined with the intrusion detection system based on behavior characteristics, and an intrusion detection server is arranged in front of the user network. The function detects all traffic passing through the user network. Once it matches the rules in the intrusion behavior rule database, it will be judged as an intrusion behavior, and the judgment result will be sent to the control server. The control server will directly modify the firewall rules to compensate for the failure of the honeynet. defense. In addition, assigning a domain name to the honeypot host will make the honeypot attract more attacks, but this will increase the potential danger of the user network.

2. Data analysis module

The data analysis module integrates, mines, and analyzes the information captured by different data capture modules, discovers possible dangerous information in the network in time, and transmits the control strategy to the data analysis module of each subnet in time to achieve early warning and real-time maintenance , periodically revised. As an example, mature technologies such as information fusion, data mining, and honeynet attack event analysis can be applied in this module. For example, mathematical methods such as clustering and matrix transformation are used to generate defensive blacklists for changing firewall rules, and to extract attack patterns and malicious codes for changing intrusion behavior rules. This module is the core module of this system. The data analysis module includes an offline analysis server, an online analysis server, a visualization server, a malicious code analysis server, a statistics database and a feature database.

(1) Online analysis server

All traffic data of the honeynet is transmitted from the remote logging server to the online analysis server. The online analysis server matches the packet header information with the attack characteristics in the signature database in real time, formulates some simple defense strategies, and blacklists the blacklists that need to be defended in real time. transmitted to the control server.

(2) Offline analysis server

All flow data of the honeynet is transmitted from the remote logging server to the offline analysis server. The offline analysis server is characterized by accuracy and complexity. It counts the indicators of the data in a cycle (hour, day, week), updates the statistical database, extracts Attack characteristics and patterns, update the signature database, predict attack trends based on previous period data, formulate defense strategies, and periodically transmit blacklists that need defense to the control server.

(3) Malicious code analysis server

The malicious code captured by the honeypot is automatically or manually transmitted to the malicious code analysis server, where the malicious code is run in its sandbox, its features are extracted, and the feature database is updated.

(4) Visualization server

The visualization server reads the data from the statistical database and the characteristic database, and draws the data into charts, so that the manager can know the operation status of the whole system in time.

3. Data control module

The data control module is the final execution module of active defense and the output module of the system, including control server, control database, router, honey wall, firewall and intrusion behavior rule database. Data control can be divided into two aspects, one is internal control, including routers and honey walls; the other is external control, including firewalls and intrusion behavior rule databases.

(1) Internal control

Internal control refers to preventing attacks from internal hosts, mainly honeypot hosts, including routers and honey walls. The router can modify the routing rules to assist the honey wall in data control. The honey wall does not impose any restrictions on the incoming network packets, allowing hackers to break into the honeynet, but strictly controls the springboard attacks launched by hackers using the honeynet. Control methods include attack packet suppression and external connection limit.

(2) External control

External control refers to preventing attacks from external hosts, including firewalls and intrusion behavior rule databases. The firewall can defend against known attackers' location and attack mode through the defense blacklist, and can ensure that the trusted host address is not mistakenly defended through the protection of the whitelist. The firewall can intercept fake IP transmission through reverse router query and filtering to reserve IP. data packets. The intrusion behavior rule database can provide defense against known attack patterns for the intrusion detection server of the data capture module.

(3) Control server

The control server is the core of the data control module, which integrates the online analysis server command, the offline analysis server command, and the data in the control database to modify the rules of the honey wall, firewall, and intrusion behavior database to achieve defense against all attacks, especially for new Attacks that emerge, even unknown ones.

(4) Control database

All commands received and issued by the control server are stored in the control database, which can be viewed and restored once a fault occurs.

4. Intrusion deception module

In order to enhance the robustness of the system, considering that the attacker will use the honeypot host as a springboard to attack other hosts in the subnet, and the firewall in the data control module intercepts the data packets sent by the honeypot to the user network, the attacker’s second If there is no response to this attack, it is likely that the invaded host is a honeypot host. Once the attacker discovers the real attributes, the honeypot host will lose its function.

As shown in Figure 2, the intrusion deception module includes a honeyfarm (honeyfarm) host, a honeywall server, and a redirection router. The honeyfarm is a mirror image of the user network, simulating the IP, port, operating system, etc. Jar technology is implemented in a host's cache. The redirection technology is used on the router to send the data packets sent by the honeypot to the user network to the host of the honey field, and the data sent by the honey field to the honeypot can be sent to the attacker through the honey wall, so the attacker thinks the attack is successful, but The system achieves the purpose of defense, and prevents the honeynet from being discovered by attackers, achieving the purpose of deception. The module frame diagram of the honeynet-based autonomous defense subsystem adding the intrusion deception module is shown in Figure 5.

The above mainly considers the logical realization of the system, the following considers the physical realization of the system, and still considers the situation that the user network is in the same network segment. In one embodiment, the honeynet can adopt three high-interaction server-side honeypot hosts (operating systems are respectively Linux, win2k, and winxp). Since the scale of the user network is not very large and the computing burden is not very large, multiple services can be combined on one host to complete. IDS is realized by snort software, and malicious code capture is realized by HoneyBow software of Peking University or malbox software of Xi’an Jiaotong University. The honeywall and data analysis module can both be placed on one host, and the honeywall software organized by honeynet has a graphical user interface, which can It can be directly used for system configuration, management, and data analysis, or use the botwall software of Xi'an Jiaotong University to analyze the intercepted pcap file, read the attack data from it, and count the distribution information of the attacking host and the distribution information of the victim port in each period. Distribution information of attack protocols, etc., cluster attack patterns according to the number of attacking hosts, attack protocols, attack ports, and average packet size, etc., and draw trend graphs from these data, make appropriate predictions, and finally send the blacklist to Firewall control rules, blacklist includes source IP address and destination port.

Based on the introduction of the honeynet-based autonomous defense subsystem above, the honeynet-based cooperative active defense system of the present invention will be described in detail below.

With the expansion of the user network, the burden on the above-mentioned autonomous defense subsystem will continue to expand, and the performance will be seriously affected. The performance problem can be solved by continuously separating the servers. However, as the user network is not in a network segment, the complexity of the user network increases, the vulnerability of the user network also increases, and the difficulty of defense increases. No matter how many honeypot hosts are added, it is difficult to reflect the different characteristics of different types of user networks in different network segments. Therefore, the defense strategy formulated by the honeynet is not applicable to users in other network segments. Therefore, it is necessary to adopt a distributed honeynet, that is, to arrange several honeypot hosts in each subnet. Here, a network segment is regarded as a subnet. Multiple subnets cooperate with each other to carry out cooperative active defense, which can effectively overcome the vulnerability of user networks and achieve better active defense effects. In addition, it adopts centralized analysis and control, which has a simple structure and is easy to deploy, which reduces the workload of the system and improves efficiency. More importantly, it realizes data sharing, interaction, coordination and synchronization of multiple sub-honeynets, improving the defensive initiative. The synergy implemented here is for each subnet, emphasizing the mutual cooperation method of each subnet, which is still an autonomous active defense for the entire user network.

Specifically, the block diagram of the honeynet-based cooperative active defense system is shown in Figure 3. The data analysis module separated from each subnet and integrated together is the core module of the whole system. In addition, some databases are also integrated together. This strengthened data analysis module is called honey center (honeycenter), including computing unit, data unit, control unit and visualization unit. The computing unit includes a statistical server, an attack pattern extraction server, a global malicious code analysis server, and a comprehensive computing server. The data unit includes a global log record database, a global statistical database, a global feature database, a global control database, and a global intrusion behavior rule database. The control unit includes The global control server, the visualization unit includes the global visualization server.

In addition, in order to ensure the robustness of the subnet and the real-time performance of the system, each subnet still retains its own local online analysis server, and mainly formulates simple real-time self-defense strategies for the subnet. The system deployment is shown in Figure 4. The distribution of subnets and honeynet centers and the direction of data flow are marked, and the distribution of each module is omitted. The cooperative active defense system also includes a data capture module, a data analysis module and a data control module. However, compared with the autonomous defense subsystem, the components of the data capture module, data analysis module and data control module of the cooperative active defense system Distributed in the honeynet center and multiple subnets.

The data capture module includes a global log record database, a honey wall in each subnet, multiple honeypot hosts, a remote log record server, and an intrusion detection server.

The data analysis module includes a statistical server, an attack pattern extraction server, a global malicious code analysis server, a comprehensive calculation server, a global visualization server, a global statistical database and a global feature database, and local online data analysis servers in each subnet.

The data control module includes a global control server, a global control database, a global intrusion behavior rule database, redirectable routers and firewalls in each subnet.

The following mainly introduces the functions of each module of the honeynet center.

(1) Remote logging server

The remote logging server transmits the attack data captured by the subnet data capturing system where it is located to the global logging database.

(2) Global logging database

The global log record database saves the attack data captured by the subnet data capture system transmitted from the remote log record server, and is used by the statistics server, attack pattern extraction server, and comprehensive computing server.

(3) Statistics server

The statistics server extracts all data from the global log record database. The items that can be counted include: distribution of data packet protocol, distribution of data packet size, distribution of port, distribution of duration, distribution of IP region, distribution of traffic, attack The distribution of ports, the distribution of attack sources, the distribution of attacked honeypots, the distribution of attack time, etc. All statistical items can be collected for the overall statistics or for some subnets. All statistical information is stored in the global statistical database. According to the statistical distribution information changing over time, the trend of attacks can be effectively predicted, which can be used as the basis for formulating defense strategies, and all statistical information can be processed into various icons, which can be intuitively reflected Trends in network security and overall system health.

(4) Attack pattern extraction server

The attack pattern extraction server mainly uses data mining and information fusion methods to extract unknown attack patterns and attack methods from log data to restore attack scenarios. First, it performs attack event filtering on all data extracted from the global logging database, keeping only packets representing attack events. Then, it processes the header data of the attack time data through a clustering algorithm, which includes the average packet size, attack duration, attack port, number of attacks, number of victim subnets, etc., thereby extracting a variety of attack patterns, from the attack The patterns can be further clustered to obtain attack methods, such as DDOS attacks, vulnerability scanning attacks, vulnerability injection attacks, worm attacks, and so on. Finally, it restores the attack scenarios based on time series analysis, and the obtained results are stored in the global feature database as the basis for formulating defense strategies for the comprehensive computing server and online analysis server, and are displayed intuitively through the visualization server. Finally, the attack pattern extraction server transmits attack features such as attack patterns to the global intrusion behavior rule database through the global control service, and actively defends against attacks that directly attack the user network.

(5) Comprehensive computing server

The comprehensive computing server comprehensively utilizes the data in the data unit to generate corresponding defense strategies for each subnet. First, it filters attack events on all data extracted from the global logging database. Then, it adopts some algorithms, such as a highly predictable blacklist generation algorithm, determines relevant parameters through the statistical database and feature database, analyzes the correlation degree of the victim subnet, the threat degree analysis of the attack behavior, and the attacker correlation degree analysis Determine the final defense strategy, such as the firewall blacklist that needs to be modified, the list of high-risk subnets that need to be notified, and the list of attacking hosts on the internal and external networks that need to be alerted. Finally, the comprehensive calculation server transmits the calculation results to the global control server.

In addition, as in the aforementioned autonomous defense subsystem, in order to enhance the robustness of the system, the cooperative active defense system may also include an intrusion deception module. The intrusion deception module includes a honeyfarm (honeyfarm) host, a honey wall server and a redirection router, and is used to deceive attackers and protect the honeynet.

Thus, using the integrated data analysis module, the cooperative active defense system has all the functions of the autonomous active defense.

For the entire network:

If the attacker is located on the external network, an attack with a known attack location will be directly blocked by the firewall. If an attack with a known attack pattern first attacks the user network, it will be discovered by the intrusion detection server, and the control server will modify the firewall rules to block the attack. Packets at the attacker's location. If an attack with a known attack pattern attacks the honeynet first, the online analysis server analyzes the location of the attacker, and the control server modifies the firewall rules to block it. If an attack with an unknown attack pattern first attacks the honeynet, through the analysis of the computing unit, extract the attack characteristics and attack patterns from the traffic characteristics and malicious code analysis, update the characteristic database, and update the firewall rules of all or part of the subnets by the control server And the intrusion behavior rule base, when the same type of attack attacks these honeynets or user networks again, it will be intercepted by the firewall, which realizes the active defense of the user network.

For a single subnet:

If the attacker is an intranet user, if an attack with a known attack pattern first attacks other users in the subnet, it will be discovered by the intrusion detection server, and the control server will notify it and alert the subnet. The attack first attacks the honeynet, the local online analysis server analyzes the location of the attacker, and the local control server notifies it and alerts the subnet. If an attack with an unknown attack pattern first attacks the honeynet, through the analysis of the honeynet center, the attack characteristics and attack patterns are extracted from the traffic characteristics and malicious code analysis, and the signature database is updated, and the control server notifies it and alerts the subnet , and update the intrusion behavior rule base to realize the active defense against intranet attacks.

If the attacker is a user in another subnet, if an attack with a known attack mode first attacks other users in this subnet, it will be discovered by the intrusion detection server, and the local control server will modify the firewall rules to block the data at the attacker's location package, the global control server notifies it and alerts the entire network. If an attack with a known attack pattern first attacks the honeynet, the online analysis server analyzes the location of the attacker, the local control server modifies the firewall rules to block it, and the global control server notifies it and alerts the entire network. If an attack with an unknown attack pattern first attacks the honeynet, through the analysis of the honeynet center, the attack signature and attack pattern are extracted from the traffic characteristics and malicious code analysis, the signature database is updated, and the local control server modifies the firewall rules to block it. The global control server notifies it and alerts the subnet, and updates the intrusion behavior rule base to realize active defense against intranet attacks.

Due to information sharing, a single subnet can use the data captured by honeynets in other subnets for defense, and the initiative and predictability are greatly improved. Attacks that were previously unknown to it are now known attacks. The chance of being attacked is greatly reduced. In addition, in order to improve the success rate of interception, the system fully considers the complexity of each subnet, that is, formulates different defense strategies for each subnet, and the higher the similarity of the subnet, the more similar the defense strategy is. Once the honeypot is compromised, the honeypot prevents the honeypot from attacking the user, and the router redirects the attack data flow to the honeyfield to prevent the honeypot from being discovered by the attacker. The defense effect is positively correlated with the analysis speed of the data unit, and inversely correlated with the analysis cycle. The faster the offline analysis, the better the effect of active defense. In addition, the defense effect is also positively correlated with the distribution breadth of honeynets, that is, the more honeynets are distributed, the better the effect of active defense.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present invention should be included in the protection of the present invention. within range.

Claims (6)

1. A cooperative active defense system based on a honeynet, comprising a data capture module, a data analysis module and a data control module, characterized in that: The data capture module, data analysis module and data control module are distributed in a honeynet center and multiple subnets, wherein, The data capture module includes a global log record database located at the honeynet center and a honey wall in each subnet, a plurality of honeypot hosts, a remote log record server, and an intrusion detection server; The data analysis module includes a statistical server located at the center of the honeynet, an attack pattern extraction server, a global malicious code analysis server, a comprehensive computing server, a global visualization server, a global statistical database and a global feature database, and local online data in each subnet analysis server; The data control module includes a global control server located at the center of the honeynet, a global control database and a global intrusion behavior rule database, as well as redirectable routers and firewalls in each subnet. 2. The honeynet-based cooperative active defense system according to claim 1, wherein, The remote log record server transmits the attack data captured by the subnet to the global log record database, and the global log record database stores the attack data transmitted by the remote log record server for use by the statistics server, attack pattern extraction server and comprehensive computing server ; The statistical server extracts all data from the global log record database, and stores all statistical information in the global statistical database as a basis for formulating defense strategies; Based on the data extracted from the global log record database, the attack pattern extraction server extracts multiple attack patterns, and transmits the attack features comprising the attack pattern to the global intrusion behavior rule database through the global control server, to directly attack the user network. conduct active defense; The comprehensive calculation server filters all data extracted from the global log record database for attack events, and then uses a highly predictable blacklist generation algorithm to determine relevant parameters through the global statistics database and global feature database, and associates the victim subnet with Degree analysis, threat analysis of attack behavior and attacker correlation analysis determine the final defense strategy and transmit the results to the global control server. 3. The honeynet-based cooperative active defense system according to claim 2, wherein, the items counted by the statistical server include: the distribution of the packet protocol, the distribution of the packet size, the distribution of the port, and the distribution of the duration , Distribution of IP regions, distribution of traffic, distribution of attacked ports, distribution of attack sources, distribution of attacked honeypots, and distribution of attack periods. 4. the cooperative active defense system based on honeynet according to claim 2, wherein, said attack mode extraction server is specifically used for: First, attack event filtering is performed on all data extracted from the global logging database, and only packets representing attack events are retained; Then, use the clustering algorithm to process the header data of the attack time data, extract a variety of attack modes, restore the attack scene according to the time series analysis, and store the obtained results in the global feature database as a comprehensive calculation server and each subnet. The basis of the local online data analysis server to formulate defense strategies, and it is displayed intuitively through the global visualization server; Finally, the attack features including the attack mode are transmitted to the global intrusion behavior rule database through the global control server, so as to actively defend against attacks that directly attack the user network. 5. The honeynet-based cooperative active defense system according to claim 4, wherein the data packet header data includes average packet size, attack duration, attack port, attack quantity, and victim subnet quantity. 6. The honeynet-based cooperative active defense system according to claim 1, preferably, also includes an intrusion deception module for deceiving an assailant, and the intrusion deception module includes a honey farm (honeyfarm) host, a honey wall server and redirect routers.

Images