| 摘要 |
PURPOSE: A hybrid interaction client honeypot system and a method for operating the same are provided to improve the accuracy of the system and to accelerate the analyzing time of the system. CONSTITUTION: A low interaction client honeypot(110) includes a web crawler(111) and an analyzing module(112) and downloads/analyzes the web pages of a web site in addition to respond to the web site. The web crawler downloads the web pages of suspicious uniform resource locators. The analyzing module statically analyzes the web pages and analyzes the obfuscation of java scripts used for suspicious web pages. A high interaction client honeypot(120) directly visits the suspicious web sites and verifies whether the web site contains malicious codes. |
