Low Interaction Honeypot Research Articles

Analysis of Cyber Attacks Using Honeypot

In the cybersecurity world, the concept of a honeypot is generally referred to as trap systems that have real system behaviors, intentionally leave a security gap, and aim to collect information about cybercriminals who want to access them. It is a computer system that sets itself as a target to attract cyberattacks like bait. It is used to imitate a target such as cyberattackers and to learn about attack attempts, ways of working, or to distract them from other targets. In this study, a VoIP-based honeypot was used to determine the profiles of cyberattacks and attackers. A network environment was created using a low-interaction honeypot to analyze the behavior of cyberattackers and identify the services frequently preferred by these individuals. The honeypot in the network environment was monitored for a period of 90 days. 105,308 events were collected regarding protocols such as Telnet, SIP, SSH, SMB, and HTTP. According to the results obtained, the proposed method performed a detailed analysis of the services from which cyberattacks came and the behaviors of the people who carried out these attacks. In addition, the highest level of understanding of user interaction was achieved thanks to the VoIP-based honeypot.

A new dynamic security defense system based on TCP_REPAIR and deep learning

Honeypot is an active defense mechanism, which attracts attackers to interact with virtual resources in the honeypot mainly by simulating real working scenarios and deploying decoy targets, so as to prevent real resources from being damaged and collect attackers’ attack processes and analyze potential system vulnerabilities to proactively respond to similar attacks. Because of the existing honeypot system has defects such as the inability to deploy specific honeypots to induce attacks based on complex attacks, the inability to select the best honeypot for dynamic response based on honeypot deployment and maintenance costs during attack interactions, and insufficient ability to identify variants of known attack methods. Although hybrid honeypots can solve some of these problems by deploying low-interaction honeypots and high-interaction honeypots, they cannot really be applied to real production scenarios because of their slow TCP connection switching speed and inability to efficiently identify encrypted malicious traffic. In this paper, we propose a new dynamic security defense system based on the combination of TCP_REPAIR-based dynamic honeypot selection architecture and a deep learning-based intelligent firewall. The system accurately distributes encrypted or non-encrypted attack traffic and its variants through the intelligent firewall. The normal traffic is sent to the actual system, and the marked malicious traffic dynamically selects honeypots to respond according to the attack process.The experimental result indicated that the system can select honeypots for targeted responses according to the actual network situation quickly and dynamically and covertly, effectively improving the utilization rate of honeypot clusters as well as the ability to decoy.

Hybrid H-DOC: A bait for analyzing cyber attacker behavior

Cyber security is a vital concern for companies with internet-based cloud networks. These networks are constantly vulnerable to attack, whether from inside or outside organization. Due to the ever-changing nature of the cyber world, security solutions must be updated regularly in order to keep infrastructure secure. With the use of attack detection approaches, security systems such as antivirus, firewalls, or intrusion detection systems have become more effective. However, conventional systems are unable to detect zero-day attacks or behavioral changes. These drawbacks can be overcome by setting up a honeypot. In this paper, a hybrid Honeynet model deployed in Docker (H-DOC) bait has been proposed that comprises both low interaction and high interaction honeypot to attract the malicious attacker and to analyze the behavioral patterns. This is a form of bait, designed to detect or block attacks, or to divert an attacker's attention away from the legitimate services. It focuses only on the SSH protocol, as it is widely used for remote system access and is a popular target of attacks. The proposed Hybrid H-DOC method identify ransomware activity, attack trends, and timely decision-making through the use of an effective rule and tunes the firewall. The attack detection accuracy of the proposed Hybrid H-DOC method when compared with IDH, Decepti-SCADA, AS-IDS and HDCM is 13.97%, 11.82%, 8.60% and 5.07% respectively.

H-DOCTOR: Honeypot based firewall tuning for attack prevention

A honeypot is a well-known entrapment technique used by network and Internet of Things (IoT) security professionals to lure intruders. Unlike traditional security measures, they can capture information in real time from the attacker about how they are attacking. A network firewall protects Internet servers from unwanted and malicious traffic. Detecting ransomware with existing security systems such as IDPS (Intrusion Detection and Protection System) and AV (Antivirus) is difficult and time-consuming. In this paper, a novel hybrid Honeynet deployed in Docker for detecting attacker behavior with Tuning Of fiRewall (H-DOCTOR) has been proposed. The proposed H-DOCTOR technique comprises both low interaction and high interaction honeypot to attract the malicious attacker and to analyze the behavioral patterns. This is a form of bait, designed to detect or block attacks, or to divert an attacker's attention away from the legitimate services and tune the firewall. The proposed H-DOCTOR method identify ransomware activity, attack trends, and timely decision-making through the use of an effective rule and tunes the firewall. The proposed H-DOCTOR framework is compared with existing methods such as HyInt,IDS and honeypot-based IDS. The proposed system achieves higher accuracy of 86% and the existing system such as HyInt,IDS and honeypot-based IDS achieves 73.25%, 76.75% and 81.25%.

Don’t get stung, cover your ICS in honey: How do honeypots fit within industrial control system security

The advent of Industry 4.0 and smart manufacturing has led to an increased convergence of traditional manufacturing and production technologies with IP communications. Legacy Industrial Control System (ICS) devices, now interconnected via public networks, are exposed to a wide range of previously unconsidered threats, which must be considered to ensure the continued safe operation of industrial processes. This paper surveys the ICS honeypot deployments in the literature to date, provides an overview of ICS focused threat vectors, and studies how honeypots can be integrated within an organisations defensive strategy. We discuss relevant legislation, such as the UK Cyber Assessment Framework, the US NIST Framework for Improving Critical Infrastructure Cybersecurity, and associated industry-based standards and guidelines supporting operator compliance. This is used to frame a discussion on our survey of existing ICS honeypot implementations, and the role of honeypots in supporting regulatory objectives. We observe that many low-interaction honeypots are limited in their use. This is largely due to the increased knowledge attackers have on how real-world ICS devices are configured and operate vs the configurability of simulated honeypot systems. Furthermore, we find that environments with increased interaction provide more extensive capabilities and value, due to their inherent obfuscation delivered through the use of real-world systems. Based on these insights, we propose a novel framework towards the classification and implementation of ICS honeypots.

Integration of Low Interaction Honeypot and ELK Stack as Attack Detection Systems on Servers

The high need for information technology that can be accessed anywhere and anytime indirectly opens a big opportunity for irresponsible parties to attack and destroy the system. The server farm is one of the targets most hunted by attackers, intending to damage, and even retrieving victim data. One of the efforts to deal with this problem is to add server security by using honeypot. The existence of a honeypot is one of the efforts to prevent system hacking by creating a fake server to divert attackers access. In its application, the logs generated from the honeypot are only letters and numbers, making it difficult to analyze the logs. It became a problem it will being a lot of log data being processed. To make it easier for administrators in analyzing logs, a visualization system using the ELK Stack is proposed. Honeypot and ELK Stack integration can be a security system solution in detecting attacks while providing visualization to administrators. Five testing schemes were carried out to provide a comparative study between the low interaction honeypot Cowrie and Dionaea. Cowrie delivers a better performance detection system (real-time) compared to the detection system offered by Dionaea, and the average delay time is 3.75 seconds, while ELK managed to provide better monitoring results to administrators through its visualization.

PROUD-MAL: static analysis-based progressive framework for deep unsupervised malware classification of windows portable executable

Enterprises are striving to remain protected against malware-based cyber-attacks on their infrastructure, facilities, networks and systems. Static analysis is an effective approach to detect the malware, i.e., malicious Portable Executable (PE). It performs an in-depth analysis of PE files without executing, which is highly useful to minimize the risk of malicious PE contaminating the system. Yet, instant detection using static analysis has become very difficult due to the exponential rise in volume and variety of malware. The compelling need of early stage detection of malware-based attacks significantly motivates research inclination towards automated malware detection. The recent machine learning aided malware detection approaches using static analysis are mostly supervised. Supervised malware detection using static analysis requires manual labelling and human feedback; therefore, it is less effective in rapidly evolutionary and dynamic threat space. To this end, we propose a progressive deep unsupervised framework with feature attention block for static analysis-based malware detection (PROUD-MAL). The framework is based on cascading blocks of unsupervised clustering and features attention-based deep neural network. The proposed deep neural network embedded with feature attention block is trained on the pseudo labels. To evaluate the proposed unsupervised framework, we collected a real-time malware dataset by deploying low and high interaction honeypots on an enterprise organizational network. Moreover, endpoint security solution is also deployed on an enterprise organizational network to collect malware samples. After post processing and cleaning, the novel dataset consists of 15,457 PE samples comprising 8775 malicious and 6681 benign ones. The proposed PROUD-MAL framework achieved an accuracy of more than 98.09% with better quantitative performance in standard evaluation parameters on collected dataset and outperformed other conventional machine learning algorithms. The implementation and dataset are available at https://bit.ly/35Sne3a.

Analysis and Implementation of Honeyd as a Low-Interaction Honeypot in Enhancing Security Systems

Every computer connected to a wide computer network is vulnerable to the occurrence of data, information, resources and services that exist in the system from actions such as intrusion, wiretapping, theft and misuse of important data to damage to network systems, which are carried out by irresponsible intruders, wiretapping, theft and misuse of important data by individuals, groups, within a company/government agency or private sector, even damage to computer network systems may occur. in a company, which is done by an intruder or attacker who is not responsible. Honeypot honeyd is a method that can be applied, implemented in medium to large scale companies, especially those that have implemented computer-based systems and technology, to prevent, anticipate bad actions before they occur and take quick action when bad impacts occur. Honeypot honeyd with low-interaction, which is to interact indirectly with the attacker, because honeyd positions itself as a bait or a shadow server that is deliberately attacked so that the results of the attack can be known and analyzed. In this research, honeyd honeypot is a shadow server that resembles a real server, which has several services along with ports that are deliberately opened for attack. The results of this research can be seen that there is an infiltration or direct attack, seen from the increase in network traffic above normal on the monitor system, and also can be seen log files from Honeyd in detail what the attackers have done or are currently doing to be analyzed and then take precautions, anticipation, socialization of security in carrying out activities that are directly related to the outside world through the network, improving both servers, network systems and existing services. Thus the honeyd honeypot can help save important data, resources and can improve computer network security systems.

Low interaction honeypot as the defense mechanism against Slowloris attack on the web server

Threats and attacks on internet services are in line with developments in internet technology. One of the main risks is Distributed Denial of Service (DDoS). In this paper, we focus on the Slowloris attack which is an open-source DDoS attacker that generally attacks the Apache webserver. Apache is one of the most popular web servers in the world and is still used by many companies. This research presents another way to reduce attacks to the firewalls and load a counterweight by using a low interaction honeypot, HoneyPy. In normal conditions, attack schemes and defense mechanisms are evaluated by conducting experiments. Slowloris attacks cause high traffic because it prevents the socket from closing, so the webserver cannot handle other connections from legitimate users. When defense mechanisms are applied to the network, Slowloris attacks that enter the webserver are minimized because most packets are discarded and directed to the honeypot without the attacker’s knowledge. It seems like the attacker has managed to attack the web server even when the attack becomes slower.

Analysis Of Using Firewall And Single Honeypot In Training Attack On Wireless Network

Security issues become one of the important aspects of a network, especially a network security on the server. These problems underlie the need to build a system that can detect threats from parties who do not have access rights (hackers) that are by building a security system honeypot. A Honeypot is a diversion of intruders' attention, in order for intruders to think that it has managed to break down and retrieve data from a network, when in fact the data is not important and the location is isolated. A way to trap or deny unauthorized use of effort in an information system. One type of honeypot is honeyd. Honeyd is a low interaction honeypot that has a smaller risk compared to high interaction types because the interaction with the honeypot does not directly involve the real system. The purpose of the implementation of honeypot and firewall, firewall is used on Mikrotik. Can be used as an administrative tool to view reports of Honeyd generated activity and administrators can also view reports that are stored in the logs in order to assist in determining network security policies.

Network traffic intelligence using a low interaction honeypot

Advancements in networking technology have seen more and more devices becoming connected day by day. This has given organizations capacity to extend their networks beyond their boundaries to remote offices and remote employees. However as the network grows security becomes a major challenge since the attack surface also increases. There is need to guard the network against different types of attacks like intrusion and malware through using different tools at different networking levels. This paper describes how network intelligence can be acquired through implementing a low-interaction honeypot which detects and track network intrusion. Honeypot allows an organization to interact and gather information about an attack earlier before it compromises the network. This process is important because it allows the organization to learn about future attacks of the same nature and allows them to develop counter measures. The paper further shows how honeypot-honey net based model for interruption detection system (IDS) can be used to get the best valuable information about the attacker and prevent unexpected harm to the network.

DEPLOYMENT OF LOW INTERACTION HONEYPOT IN A PRIVATE NETWORK

A honeypot is a security system whose value lies in being probed ,attacked .A honeypot is forcefully made to be attacked to gather information about unauthorized activity Our research paper provides a brief explanation of such a system and demonstrate how it can be implemented to improve security of the organization and across critical systems and networks. In the experiment performed in this paper, such a trap is laid in the form of a low interaction honeypot deployed using pentbox 1.8 framework in a private network. The results of deployment are presented. .

A Hybrid Honeypot Scheme for Distributed Denial of Service Attack

The main challenge in network security is keeping up with all threat types that arise every day. Traditional security mechanisms such as firewalls and Intrusion Detection System (IDS) do not provide detection for new attacks or helping in learning new attackers’ techniques. This paper presents a hybrid honeypot scheme that combines low and high interaction honeypots to mitigate the shortcomings of both types. The low interaction honeypots are used to emulate operating systems and services, and for any outbound connection, they act as a proxy to forward the packets to real systems in high interaction honeypot. The scheme is tested by applying Distributed Denial of Service attack (DDOS) against the system, and a significant enhancement to the system security is achieved. The results show that the performance of the IDS has been improved comparing with traditional IDS. Furthermore, the false positive rate is reduced, and the true positive rate is enhanced.

Securing Distributed Computer Systems Using an Advanced Sophisticated Hybrid Honeypot Technology

Computer system security is the fastest developing segment in information technology. The conventional approach to system security is mostly aimed at protecting the system, while current trends are focusing on more aggressive forms of protection against potential attackers and intruders. One of the forms of protection is also the application of advanced technology based on the principle of baits - honeypots. Honeypots are specialized devices aimed at slowing down or diverting the attention of attackers from the critical system resources to allow future examination of the methods and tools used by the attackers. Currently, most honeypots are being configured and managed statically. This paper deals with the design of a sophisticated hybrid honeypot and its properties having in mind enhancing computer system security. The architecture of a sophisticated hybrid honeypot is represented by a single device capable of adapting to a constantly changing environment by using active and passive scanning techniques, which mitigate the disadvantages of low-interaction and high-interaction honeypots. The low-interaction honeypot serves as a proxy for multiple IP addresses and filters out traffic beyond concern, while the high-interaction honeypot provides an optimum level of interaction. The proposed architecture employing the prototype of a hybrid honeypot featuring autonomous operation should represent a security mechanism minimizing the disadvantages of intrusion detection systems and can be used as a solution to increase the security of a distributed computer system rapidly, both autonomously and in real-time.

SSH Honeypot: Building, Deploying and Analysis

This article is set to discuss the various techniques that can be used while developing a honeypot, of any form, while considering the advantages and disadvantages of these very different methods. The foremost aims are to cover the principles of the Secure Shell (SSH), how it can be useful and more importantly, how attackers can gain access to a system by using it. The article involved the development of multiple low interaction honeypots. The low interaction honeypots that have been developed make use of the highly documented libssh and even editing the source code of an already available SSH daemon. Finally the aim is to combine the results with the vastly distributed Kippo honeypot, in order to be able to compare and contrast the results along with usability and necessity of particular features. Providing a clean and simple description for less knowledgeable users to be able to create and deploy a honeypot of production quality, adding security advantages to their network instantaneously.

Capture and Analysis of Malicious Traffic in VoIP Environments Using a Low Interaction Honeypot

The number of users of VoIP services is increasing every year. Consequently, VoIP systems get more attractive for attackers. This paper describes the implementation of a low interaction honeypot for monitoring illegal activities in VoIP environments. The honeypot operated during 92 days and collected 3502 events related to the SIP protocol. The analysis of the results allows understanding the modus operandi of the attacks targeted to VoIP infrastructures. These results may be used to improve defense mechanisms such as firewalls and intrusion detection systems.

A New Procedure to Detect Low Interaction Honeypots

Honeypots systems are an important piece of the network security infrastructure and can be deployed to accomplish different purposes such as: network sensing, capturing and learning about 0-day exploits, capturing and analyzing of black hat techniques, deterring black hats and data gathering for doing statistical analysis over the Internet traffic, among others. Nevertheless, all honeypots need to look like real systems, due to if a honeypot is unmasked, it loses its value. This paper presents a new procedure to detect low interaction honeypots, through HTTP request, regardless honeypot architecture. It is important to mention that Low Interaction Honeypots network services need to be improved in order to get trustworthy information. Otherwise, it should consider data obtained by low interaction honeypots like inaccurate and unreliable information. DOI: http://dx.doi.org/10.11591/ijece.v4i6.6885

ANALISIS SISTEM KEAMANAN HOTSPOT DENGAN MENGGUNAKAN HONEYPOT DAN IDS DI KAMPUS STMIK PPKIA PRADNYA PARAMITA MALANG

Campus STMIK PPKIA Pradnya Paramita Malang an informatics-based private university in Malang. Security Hotspot used Mikrotik is using a security system. Users who use Hotspot itself is the lecturer and students. Honeypot and IDS is a tool to help security systems that still use Mikrotik Hotspot. Every time there is an attack action using Hotspot then stored into a log of activities each server. Honeypot itself is useful as a shadow Server or Server fake to fool the server where the original moment of the attack. The attack can be done in antaralain Hotspot network using scanning techniques, Arp Spoofing and DDOS. The ultimate goal of this research is to provide a recommendation of Honeypot and IDS analysis results that are tailored to the security system "STMIK PPKIA Pradnya Paramita Malang" and determine the performance of software after testing on Honeypot and IDS. The results of the study indicated that the Snort IDS is able to give a warning on the attack quite well and would be even better if combined with a low interaction and high interaction honeypot honeypot because besides being able to provide better alerting honeypot able to learn what is done by the attacker. Keywords: Honeypot - IDS, Snort, Mikrotik, Server,STMIK PPKIA Pradnya Paramita Malang

Markov Chain Based Roaming Schemes for Honeypots

The paper proposes a reactive roaming scheme for honeypots. The main aim of a honeypot is to capture the activities of the attacker. If the attacker detects honeypot on a system, its value drops. So, the concept of roaming honeypots is being proposed, to prevent the attacker from detecting the honeypot, which in turn increases the efficiency of honeypot and allows collecting rich data about activities of active attackers. The honeypot is shifted to another system which is most probable to be attacked within the network. The concept of Markov chain analysis is being used to detect the most probable system to be attacked based on the current status of the network. Further, using IP shuffling and services on/off concepts, honeypots roam on the network to the most probable system to be attacked using the threat score. Snort is used to capture data about the number of attacks on each of the nodes of the network and the data collected is then used as an input for Markov chain analysis to identify the most probable system where honeypot can be roamed/moved. The roaming scheme has been implemented for both high interaction honeypots and low interaction honeypots. The high interaction implementation helps in capturing in depth information on a shorter range of IP addresses, whereas the low interaction implementation is efficient in capturing information on a large range of IP addresses. The main advantage of this approach is that it predicts the frequency of attacks on the nodes of a particular network and takes a reactive step by starting the honeypot services on that particular node/system on the network.

Improving Honeyd for Automatic Generation of Attack Signatures

In this paper, we design and implement a new Plugin to Honeyd which generates attack signature, automatically. Current network intrusion detection systems work on misuse detectors, where the packets in the monitored network are compared against a repository of signatures. But, we focus on automatic signature generation from malicious network traffic. Our proposed system inspects honeypot traffic and generates intrusion signatures for unknown traffic.The signature is based on traffic patterns, using Longest Common Substring (LCS) algorithm. It is noteworthy that our system is a plugin to honeyd - a low interaction honeypot. The system's output is a file containing honeypot intrusion signatures in pseudo-snort format. Signature generation system has been implemented for Linux Operating System (OS) but due to the common use of Windows OS, we implement for Windows OS, using C programming language.