Electronic apparatus for implementing honeypot control system and control method thereof
Disclosed is an electronic apparatus for implementing a honeypot control system. The electronic apparatus includes a communication interface, a memory configured to store execution information including information on a virtual machine built on a cloud server, information on a running service, and information on an open port, and a processor configured to functionally control the communication interface and the memory, wherein the processor is configured to transmit execution information obtained based on information stored in the memory to each of a plurality of cloud servers in different Internet Protocol (IP) bands through the communication interface, when log information is received from each of the plurality of cloud servers that have received the execution information through the communication interface, normalize the received log information, and obtain malicious code information using the normalized log information.
1 . An electronic apparatus for implementing a honeypot control system, the electronic apparatus comprising:
a communication interface;
a memory configured to store execution information including information on a virtual machine built on a cloud server, information on a running service, and information on an open port; and
a processor configured to functionally control the communication interface and the memory,
wherein the processor is configured to:
transmit execution information obtained based on information stored in the memory to each of a plurality of cloud servers in different Internet Protocol (IP) bands through the communication interface,
when log information is received from each of the plurality of cloud servers that have received the execution information through the communication interface, normalize the received log information, and
obtain malicious code information using the normalized log information,
wherein the plurality of cloud servers are implemented as different types of honeypot platforms, and
wherein the processor is further configured to:
when log information of different log types is received from each of the plurality of cloud servers implemented as different types of honeypot platforms, parse and normalize the received log information of different log types by item, and
index the normalized log information of different log types and store the indexed log information in the memory.
2 . The electronic apparatus of claim 1 , wherein the processor is further configured to identify statistical data by item on the basis of the log information stored in the memory, and
provide a user interface (UI) including the identified statistical data.
3 . The electronic apparatus of claim 1 , wherein, in the plurality of cloud servers, a plurality of servers are communicatively connected to each other to be implemented as a single cluster and different regions are assigned to each of the plurality of servers.
4 . A honeypot system including a plurality of cloud servers and an electronic apparatus,
wherein the electronic apparatus is configured to transmit execution information including information on a virtual machine built on a cloud server, information on a running service, and information on an open port to each of the plurality of cloud servers, when log information is received from each of the plurality of cloud servers that have received the execution information, normalize the received log information, and obtain malicious code information using the normalized log information, and
wherein the plurality of cloud servers are configured to build one or more virtual machines on the basis of the execution information received from the electronic apparatus, execute at least one service corresponding to each of the one or more built virtual machines, and transmit the log information obtained through the running service to the electronic apparatus,
wherein the plurality of cloud servers are implemented as cloud servers in different IP bands,
wherein the plurality of cloud servers are implemented as different types of honeypot platforms, and
wherein the electronic apparatus is further configured to:
when log information of different log types is received from each of the plurality of cloud servers implemented as different types of honeypot platforms, parse and normalize the received log information of different log types by item, and
index the normalized log information of different log types and store the indexed log information in a memory.
5 . A control method of an electronic apparatus for implementing a honeypot control system, the control method comprising:
transmitting execution information including information on a virtual machine built on a cloud server, information on a running service, and information on an open port to each of a plurality of cloud servers in different Internet Protocol (IP) bands;
when log information is received from each of the plurality of cloud servers that have received the execution information, normalizing the received log information; and
obtaining malicious code information using the normalized log information, wherein the plurality of cloud servers are implemented as different types of honeypot platforms,
wherein the normalizing of the received log information includes, when log information of different log types is received from each of the plurality of cloud servers implemented as different types of honeypot platforms, parsing and normalizing the received log information of different log types by item, and
wherein the control method further includes indexing the normalized log information of different log types and storing the indexed log information in a memory.
6 . The control method of claim 5 , further comprising:
identifying statistical data by item on the basis of the log information stored in the memory; and
providing a user interface (UI) including the identified statistical data.
7 . The control method of claim 5 , wherein, in the plurality of cloud servers, a plurality of servers are communicatively connected to each other to be implemented as a single cluster and different regions are assigned to each of the plurality of servers.
8 . A non-transitory computer-readable recording medium for storing a computer program executed by a processor of an electronic apparatus for implementing a honeypot control system to perform a control method including:
transmitting execution information including information on a virtual machine built on a cloud server, information on a running service, and information on an open port to each of a plurality of cloud servers in different Internet Protocol (IP) bands;
when log information is received from each of the plurality of cloud servers that have received the execution information, normalizing the received log information; and
obtaining malicious code information using the normalized log information,
wherein the plurality of cloud servers are implemented as different types of honeypot platforms,
wherein the normalizing of the received log information includes, when log information of different log types is received from each of the plurality of cloud servers implemented as the different types of honeypot platforms, parsing and normalizing the received log information of different log types by item, and
wherein the control method further includes indexing the normalized log information of different log types and storing the indexed log information in a memory.