A honeypot is a non-production system, design to interact with cyber-attackers to collect intelligence on attack techniques and behaviors. There has been great amount of work done in the field of network intrusion detection over the past three decades. With networks getting faster and with the increasing dependence on the Internet both at the personal and commercial level, intrusion detection b...

We have deployed a honeypot sensor node in Uganda that is connected to a distributed honeypot system managed by Leurrecom.org Honeypot project, which constitutes of a large number of different honeypot sensors distributed across different continents. Once joined the project, the system allows access to the whole dataset collected by all sensors in the distributed system. We use the data collect...

Botnets have become one of the major attacks in current Internet due to their illicit profitable financial gain. Meanwhile, honeypots have been successfully deployed in many computer security defense systems. Since honeypots set up by security defenders can attract botnet compromises and become spies in exposing botnet membership and botnet attacker behaviors, they are widely used by security d...

The objective of honeypot database (context honeypot) is to identify a potential privacy violator. A suspected user’s interaction with the database is analyzed to determine suspicion. Such a system must satisfy certain characteristics. One of the such characteristics is obliviousness. The success of such a system depends on its remaining oblivious to the suspected user. In this demo paper, we d...

In recent years, the emerging Internet-of-Things (IoT) has led to concerns about the security of networked embedded devices. There is a strong need to develop suitable and costefficient methods to find vulnerabilities in IoT devices in order to address them before attackers take advantage of them. In traditional IT security, honeypots are commonly used to understand the dynamic threat landscape...

A honeypot is a type of security facility deliberately created to be probed, attacked, and compromised. It is often used for protectingproduction systemsbydetecting anddeflectingunauthorized accesses. It is also useful for investigating the behavior of attackers, and in particular, unknown attacks. For the past 17 years plenty of effort has been invested in the research and development of honey...

This paper presents the design of a secured highinteraction honeypot. The challenge is to have a honeypot that welcomes attackers, allows userland malicious activities but prevents from system corruption. The honeypot must be scalable to authorize a large amount of malicious activities and to analyze those activities efficiently. The hardening of the honeypot is proposed for two kinds of host. ...

Honeypots are decoy systems that lure attackers by presenting them with a seemingly vulnerable system. They provide an early detection mechanism as well method for learning how adversaries work and think. However, over the last years number of researchers have shown methods fingerprinting honeypots. This significantly decreases value honeypot; if attacker is able to recognize existence such sys...

A honeypot is a closely monitored network decoy serving several purposes: it can distract adversaries from more valuable machines on a network, can provide early warning about new attack and exploitation trends, or allow in-depth examination of adversaries during and after exploitation of a honeypot. Deploying a physical honeypot is often time intensive and expensive as different operating syst...

This paper analyses data collected over a nine month period in a simple VoIP honeypot based on simple design initially put forward by Usken(2009). The honeypot collected 2083 events of malfeasant activity directed towards commonly used VoIP ports. These events resulted in a range of activity being recorded from simple enumeration to advanced probing and attempts to compromise the victim honeypo...