GQ: Realizing a System to Catch Worms in a Quarter Million Places

A key tool for detecting new worm outbreaks in their early stages is the honeyfarm, a large collection of honeypots fed Internet traffic by a “network telescope”. However, actual operation of a honeyfarm in a large-scale environment presents difficult scaling challenges. We discuss the structure and implementation of GQ, a honeyfarm system we built to analyze in real-time the scanning probes seen on a quarter million Internet addresses. GQ’s architecture emphasizes high fidelity, scalability, isolation, stringent control, and wide coverage. We examine how the implementation endeavors to achieve each of these, evaluate its effectiveness in doing so, and report on preliminary experiences with operating the system at scale, during which we captured 66 distinct worms over the course of four months.