Electronic apparatus for implementing honeypot control system and control method thereof

A honeypot system including a plurality of cloud servers and an electronic apparatus,

• wherein the electronic apparatus is configured to transmit execution information including information on a virtual machine built on a cloud server, information on a running service, and information on an open port to each of the plurality of cloud servers, when log information is received from each of the plurality of cloud servers that have received the execution information, normalize the received log information, and obtain malicious code information using the normalized log information, and
• wherein the plurality of cloud servers are configured to build one or more virtual machines on the basis of the execution information received from the electronic apparatus, execute at least one service corresponding to each of the one or more built virtual machines, and transmit the log information obtained through the running service to the electronic apparatus,
• wherein the plurality of cloud servers are implemented as cloud servers in different IP bands,
• wherein the plurality of cloud servers are implemented as different types of honeypot platforms, and
• wherein the electronic apparatus is further configured to:
• when log information of different log types is received from each of the plurality of cloud servers implemented as different types of honeypot platforms, parse and normalize the received log information of different log types by item, and
• index the normalized log information of different log types and store the indexed log information in a memory.

A control method of an electronic apparatus for implementing a honeypot control system, the control method comprising:

• transmitting execution information including information on a virtual machine built on a cloud server, information on a running service, and information on an open port to each of a plurality of cloud servers in different Internet Protocol (IP) bands;
• when log information is received from each of the plurality of cloud servers that have received the execution information, normalizing the received log information;
• and
• obtaining malicious code information using the normalized log information, wherein the plurality of cloud servers are implemented as different types of honeypot platforms,
• wherein the normalizing of the received log information includes, when log information of different log types is received from each of the plurality of cloud servers implemented as different types of honeypot platforms, parsing and normalizing the received log information of different log types by item, and
• wherein the control method further includes indexing the normalized log information of different log types and storing the indexed log information in a memory.

A non-transitory computer-readable recording medium for storing a computer program executed by a processor of an electronic apparatus for implementing a honeypot control system to perform a control method including:

• transmitting execution information including information on a virtual machine built on a cloud server, information on a running service, and information on an open port to each of a plurality of cloud servers in different Internet Protocol (IP) bands;
• when log information is received from each of the plurality of cloud servers that have received the execution information, normalizing the received log information;
• and
• obtaining malicious code information using the normalized log information,
• wherein the plurality of cloud servers are implemented as different types of honeypot platforms,
• wherein the normalizing of the received log information includes, when log information of different log types is received from each of the plurality of cloud servers implemented as the different types of honeypot platforms, parsing and normalizing the received log information of different log types by item, and
• wherein the control method further includes indexing the normalized log information of different log types and storing the indexed log information in a memory.