蜜罐的捕獲能力來(lái)自于其數(shù)量和分布位置，在同一網(wǎng)絡(luò)拓?fù)渲?，運(yùn)用合理的部署策略，
可以部署最少的蜜罐，在最短的時(shí)間內(nèi)捕獲到蠕蟲(chóng)樣本。本文討論了蜜罐以及蠕蟲(chóng)掃描策略的研究?jī)?nèi)容，對(duì)紅色代碼蠕蟲(chóng)進(jìn)行了深入的分析，根據(jù)隨機(jī)掃描掃描策略建立了蜜罐部署策略模型，針對(duì)紅色代碼這種網(wǎng)絡(luò)蠕蟲(chóng)的掃描策略，在模擬環(huán)境下對(duì)蜜罐部署策略進(jìn)行了驗(yàn)證。
關(guān)鍵詞：網(wǎng)絡(luò)蠕蟲(chóng)；分布式蜜罐；部署策略
Abstract：The capture ability of honeypot comes from its number and the distributed places. In the same network topology, by using proper deployment strategy, the number of honeypot and the worm capturing time can both be minimized. Here we discuss the research content of honeypot and the scan strategy of the internet worms ,and analyze the principium of RedCode worm, we also establish a honeypot deployment strategy model based on network worm scan strategy. Finally, we validate the honeypot deployment strategy against RedCode worm scan strategy int network simulation environment.
Key words：internet worm, distributed honeypot, deployment strategy