Abstract: Aiming at the disadvantage of static deployment and maintenance in Honeynet，an idea of dynamic deploy and relevant algorithms is proposed.The dynamic Honeynet can monitor itself and real-time network environment，collect clews and automatically determine what type honeypots to deploy and how to select topology.When security situation is changed，it can adjust the structure of Honeynet in real-time.The first phase of dynamic deployment is that it will forecast the security situation through grey forecast model.Then the virtual honeypots will be changed by imitating the biology actions.So the dynamic Honeynet has the ability of disguise according to the real-time intrusion.It improves the effect in confusing hackers and weakening the attack.The model and relevant algorithms is presented.A prototype is designed based on Honeyd which is a famous open source software.The experimental results show that dynamic deploy scheme has perferable feasibility and better effect in deceiving hackers with lower cost compared to the static deploy scheme.

Key words: Honeynet, dynamic deploy, grey forecast, biology imitation

摘要： 针对蜜网系统在静态配置和维护方面存在的缺陷，提出了蜜网动态部署的思想及相应的算法。动态部署的蜜网系统，通过监控自身和物理网络环境收集信息，能够自动确定配置蜜网节点的类型及拓扑结构；当网络安全态势发生改变时能实时调整蜜网的结构。动态部署的第一阶段是融合蜜网及物理网络的信息对当前网络安全态势进行预测，然后蜜网中的虚拟节点仿照生物存活的算法进行动态调整。因此该动态部署体系能针对实时入侵活动来调整自身结构，具有更高的隐蔽性，对迷惑和降低黑客的攻击力作用较大。给出了蜜网部署的设计模型和相关算法，并在开源软件Honeyd基础上设计了原型系统。实验结果表明，动态部署方案在实践中具有较好的可行性，且在不提高成本的基础上比静态部署方案诱骗效果好。

关键词: 蜜网, 动态部署, 灰色预测, 拟生算法