Automating the Analysis of Honeypot Data
نویسندگان
چکیده
We describe the on-going work towards further automating the analysis of data generated by a large honeynet architecture called Leurre.com and SGNET. The underlying motivation is helping us to integrate the use of honeypot data into daily network security monitoring. We propose a system based on two automated steps: i) the detection of relevant attack events within a large honeynet traffic data set, and ii) the extraction of highly similar events based on temporal correlation.
منابع مشابه
A Dynamic Approach for Honeypot Management
Honeypot is a security device the value of which lies mainly in discovering and inspecting, being attacked and being at risk. Most of the present Honeypots are configured and installed on the network statically. In some cases considerations have been made on dynamic configuration of Honeypots at the time of installation but still no study have been carried out on how to instantaneously change t...
متن کاملAn Advanced Hybrid Honeypot for Providing Effective Resistance in Automatic Network Generation
Increasing usage of Internet and computer networks by individuals and organizations and also attackers’ usage of new methods and tools in an attempt to endanger network security, have led to the emergence of a wide range of threats to networks. A honeypot is one of the basic techniques employed for network security improvement. It is basically designed to be attacked so as to get the attackers’...
متن کاملTowards Automating Analysis of Large-Scale Honeynet Events
Inspired by the work of Yegneswaran and colleagues on “Internet situational awareness” [30], we investigate ways to analyze data captured by honeynets—unused address blocks on which we deploy honeypot responders in order to elicit information about incoming probes—to understand the significance of large-scale “events” seen by the honeynet. In such events, an entire collection of remote hosts to...
متن کاملA Dynamic Approach for Honeypot Management
Honeypot is a security device the value of which lies mainly in discovering and inspecting, being attacked and being at risk. Most of the present Honeypots are configured and installed on the network statically. In some cases considerations have been made on dynamic configuration of Honeypots at the time of installation but still no study have been carried out on how to instantaneously change t...
متن کاملAn Analysis of Malfeasant Activity Directed at a VoIP Honeypot
This paper analyses data collected over a nine month period in a simple VoIP honeypot based on simple design initially put forward by Usken(2009). The honeypot collected 2083 events of malfeasant activity directed towards commonly used VoIP ports. These events resulted in a range of activity being recorded from simple enumeration to advanced probing and attempts to compromise the victim honeypo...
متن کامل