Low Interaction Honeypot Research Articles

Characterizing Honeypot-Captured Cyber Attacks: Statistical Framework and Case Study

Rigorously characterizing the statistical properties of cyber attacks is an important problem. In this paper, we propose the {\em first} statistical framework for rigorously analyzing honeypot-captured cyber attack data. The framework is built on the novel concept of {\em stochastic cyber attack process}, a new kind of mathematical objects for describing cyber attacks. To demonstrate use of the framework, we apply it to analyze a low-interaction honeypot dataset, while noting that the framework can be equally applied to analyze high-interaction honeypot data that contains richer information about the attacks. The case study finds, for the first time, that Long-Range Dependence (LRD) is exhibited by honeypot-captured cyber attacks. The case study confirms that by exploiting the statistical properties (LRD in this case), it is feasible to predict cyber attacks (at least in terms of attack rate) with good accuracy. This kind of prediction capability would provide sufficient early-warning time for defenders to adjust their defense configurations or resource allocations. The idea of "gray-box" (rather than "black-box") prediction is central to the utility of the statistical framework, and represents a significant step towards ultimately understanding (the degree of) the {\em predictability} of cyber attacks.

An Intellectual Approach for Providing Secure Environment in Real World Web Application

In recent years, widespread adoption of the internet has resulted in rapid advancement in information technologies. Internet is used by the general population for the purposes such as financial transactions, educational activities and countless other activities. This development of the Internet use has unfortunately been accompanied by a growth of malicious activity in the web application. Every organization uses web application for accessing their data from the database, these applications use user inputs to create a query for storing, retrieving data from the database. Although all the organizations are concerned about their data security, the attackers can still corrupt the data by using the techniques like SQL injection, Hijack future session attack, Privilege Escalation attack, which are commonly referred to as intrusion, it also includes another Application layer attack called DDoS attack. In this paper we present a novel approach for detecting all the intrusions and Application layer attack by analyzing user behavior and analyzing the user input queries using low interaction Honeypot technique.

Design and Implementation of Dynamic Hybrid Virtual Honeypot Architecture for Attack Analysis

Honeypots are dedicated machines whose aim is to delay and divert attackers away from critical resources in order to study new methods and tools used by attackers. However, when looking most of current honeypot systems are statically configured and managed. They are either low interaction honeypot or high interaction honeypot. On this paper, we proposed Dynamic Hybrid Virtual Honeypots Architecture in a single machine. It is capable of adapting in constantly changing network environment using both active and passive scanning. It also mitigates the drawback of low and high interaction honeypots. We use low interaction honeypots as proxy to claim for multiple IP address and to filter uninteresting traffic whereas high interaction honeypots to give optimal level of realism. To capture, analyze and control attack method and tools we used a gateway. Finally, we deploy the proposed architecture and present statically analysis of attacks. The experiment result proves this architecture can claim for multiple IP address, filter uninteresting traffic and gives a realism response for attacker.

A dynamic approach to generate behavior patterns of Virus and Worms for Intrusion Detection System

In today’s society people become more and more dependent on computer systems. It is therefore vital that such systems are up and running at all times. One factor that has the power to destroy the availability is computer network attacks (CNA). (CNA are defined as methods aimed at destroying, altering or obstructing information in computers, computer networks or the networks themselves). Unfortunately, the Internet show an increasing trend regarding the usage of malicious activities such as intrusion attempts, denial-of-service attacks, phishing, spamming and worms. Some automated attacks can compromise a large number of computers in a short period of time. To try to minimize this threat, it would be nice to have a security system which has the ability to detect new attacks and react on them. This work focuses on seeing how good IDS rules that can be generated automatically based on data logged by a simple honypot. The result will be based on data collected by a network intrusion detection system named SNORT, a low-interaction honeypot named honeyd and a vulnerability scanner named Nessus. Keywords: Intrusion Detection, Honey pots, Longest common Substring, Worms, Confusion matrix

Modern virtual decoy systems based on honeypot technology

In the article the analysis of existed virtual decoy systems based on honeypot technology was carried out. The analysis showed the evolution of honeypot systems from Low-Interaction Honeypots to modern Gen III Honeynets and pointed to the disadvantages of existed solutions. In addition the classification of honeypot systems by the feature principle was fulfilled. Later these results can be used to develop honeypot systems for efficiency increasing of information security incident management systems.

Honeypot trace forensics: The observation viewpoint matters

In this paper, we propose a method to identify and group together traces left on low interaction honeypots by machines belonging to the same botnet(s) without having any a priori information at our disposal regarding these botnets. In other words, we offer a solution to detect new botnets thanks to very cheap and easily deployable solutions. The approach is validated thanks to several months of data collected with the worldwide distributed Leurré.com system. To distinguish the relevant traces from the other ones, we group them according to either the platforms, i.e. targets hit or the countries of origin of the attackers. We show that the choice of one of these two observation viewpoints dramatically influences the results obtained. Each one reveals unique botnets. We explain why. Last but not the least, we show that these botnets remain active during very long periods of times, up to 700 days, even if the traces they left are only visible from time to time. 1 1 The present paper is an extended version of Pham and Dacier (2009) [25].

Malware Sandbox Analysis for Secure Observation of Vulnerability Exploitation

Exploiting vulnerabilities of remote systems is one of the fundamental behaviors of malware that determines their potential hazards. Understanding what kind of propagation tactics each malware uses is essential in incident response because such information directly links with countermeasures such as writing a signature for IDS. Although recently malware sandbox analysis has been studied intensively, little work is done on securely observing the vulnerability exploitation by malware. In this paper, we propose a novel sandbox analysis method for securely observing malware's vulnerability exploitation in a totally isolated environment. In our sandbox, we prepare two victim hosts. We first execute the sample malware on one of these hosts and then let it attack the other host which is running multiple vulnerable services. As a simple realization of the proposed method, we have implemented a sandbox using Nepenthes, a low-interaction honeypot, as the second victim. Because Nepenthes can emulate a variety of vulnerable services, we can efficiently observe the propagation of sample malware. In the experiments, among 382 samples whose scan capabilities are confirmed, 381 samples successfully started exploiting vulnerabilities of the second victim. This indicates the certain level of feasibility of the proposed method.

Hybrid Honeypot System for Network Security

Nowadays, we are facing with network threats that cause enormous damage to the Internet community day by day. In this situation, more and more people try to prevent their network security using some traditional mechanisms including firewall, Intrusion Detection System, etc. Among them honeypot is a versatile tool for a security practitioner, of course, they are tools that are meant to be attacked or interacted with to more information about attackers, their motives and tools. In this paper, we will describe usefulness of low-interaction honeypot and high-interaction honeypot and comparison between them. And then we propose hybrid honeypot architecture that combines low and high -interaction honeypot to mitigate the drawback. In this architecture, low-interaction honeypot is used as a traffic filter. Activities like port scanning can be effectively detected by low-interaction honeypot and stop there. Traffic that cannot be handled by low-interaction honeypot is handed over to high-interaction honeypot. In this case, low-interaction honeypot is used as proxy whereas high-interaction honeypot offers the optimal level realism. To prevent the high-interaction honeypot from infections, containment environment (VMware) is used. Keywords—Low-interaction honeypot, High-interaction honeypot, VMware, Proxy

A hybrid honeypot framework for improving intrusion detection systems in protecting organizational networks

This paper proposes a hybrid and adaptable honeypot-based approach that improves the currently deployed IDSs for protecting networks from intruders. The main idea is to deploy low-interaction honeypots that act as emulators of services and operating systems and have them direct malicious traffic to high-interaction honeypots, where hackers engage with real services. The setup permits for recording and analyzing the intruder's activities and using the results to take administrative actions toward protecting the network. The paper describes the basic components, design, operation, implementation and deployment of the proposed approach, and presents several performance and load testing scenarios. Implementation and performance plus load testing show the adaptability of the proposed approach and its effectiveness in reducing the probability of attacks on production computers.