Honeypot-based Forensics
نویسندگان
چکیده
Some attacks on honeypots are very frequent and repetitive. In addition, such repetitive attacks generate a very large amount of data. In this paper, we show that it might be misleading to consider general statistics obtained on these data without carrying an in depth analysis of the various processes that have led to their creation. We show that such analysis can be done by means of a simple clustering approach. We present an algorithm to characterize the root causes of these attacks. This algorithm enables us to obtain precious and non trivial information to identify the various attacks targeting our environment. We use this algorithm to identify root causes of the data collected from our honeypot environment. We demonstrate that identifying the root causes is a prerequisite for a better understanding of malicious activity observed thanks to honeypots environments. Finally, we hope this work will open new avenues for the ongoing work related to honeynets.
منابع مشابه
The Honeynet Files
exploits in a honeypot is an unusual event). For the latter, we want a better understanding of the areas of interest and hidden links between blackhat teams. One way to achieve these goals is to increase the verbosity of our honeypot logs and traces so that we learn every single action the intruder made. The most common tools for doing this are Sebek (http://project.honeynet.org/tools/ sebek/) ...
متن کاملImplementation of Network Forensics Based on Honeypot
For years, numbers of researches had addressed the serious matters of network attacks, and developed various technologies such as firewalls and intrusion detection systems to prevent the malware attacking. Currently, technologies lack any investigative features because of the network information gathering is too difficult. In this study, we designed a network forensics system, which contented h...
متن کاملDesign of Network Forensic System Based on Honeynet
Network forensics deals with the capturing and analysis of the trace and logs of network intrusions from the multiple systems for providing the information to characterize intrusion or features. This paper demonstrates the internal working of implementation of server honeypot technology and network forensics. Honeypot based system is used to attract the attackers so that their process methodolo...
متن کاملAvoiding Cyber-attacks to DMZ and Capturing Forensics from Intruders Using Honeypots
Nowadays, honeypots are widely used to divert attackers from the original target and keep them busy within a decoy environment. DeMilitarized Zone (DMZ) is an important zone for network administrators, because many of the services to the public network is provided at this zone. Many of the security tools such as firewalls, intrusion detection systems and several other secu...
متن کاملHoneypots Aiding Network Forensics: Challenges and Notions
risks as attacks are increasing day after day. Network forensics is the process of investigation such attacks through analyzing network data and events. Many challenges are facing investigators due to the rapid growing of network scale and intruders’ skills. Honeypots are computer traps that are meant to be compromised to attract hackers and monitor their strategies and tools. Using honeypots p...
متن کاملHoneypot technologies and their applicability as an internal countermeasure
Honeypots or honeynets are a technology that is rapidly maturing and establishing this archetype of countermeasure as viable and useful in modern network defence. Honeypot technology is now at a point of development where near real-time monitoring and forensic analysis of security events can occur. This paper explores the hurdles to be overcome for the internal deployment of honeypot technologies.
متن کامل