An Active Intrusion-Confronting System Using Fake Session and honeypot

In the coming age of information warfare, information security patterns need to be changed to use an active approach using offensive security mechanisms rather than the traditional passive approach in merely protecting against intrusions. In an active security environment, it is essential that, when detecting an intrusion, it is immediately confronted with methods such as analysing the intrusion situation in real-time, protecting information from the attacks, and even tracing the intruder. This paper presents an active intrusion-confronting system using a fake session and a honeypot. Through the fake session, attacks like DoS(Denial of Service) and port scan can be intercepted. By monitoring a honeypot system, in which the intruders are migrated from the protected system and an intrusion rule manager is activated, new intrusion rules are created and activated for confronting the next intrusions.