Traditional Honeypot Research Articles

ADAPT: Adaptive Camouflage Based Deception Orchestration For Trapping Advanced Persistent Threats

Honeypots serve as a valuable deception technology, enabling security teams to gain insights into the behaviour patterns of attackers and investigate cyber security breaches. However, traditional honeypots prove ineffective against advanced adversaries like APT groups due to their evasion tactics and awareness of typical honeypot solutions. This paper emphasises the need to capture these attackers for enhanced threat intelligence, detection, and protection. To address this, we propose the design and deployment of a customized honeypot network based on adaptive camouflaging techniques. Our work focuses on orchestrating a behavioral honeypot network tailored for three APT groups, with strategically positioned attack paths aligning with their Tactics, Techniques, and Procedures, covering all cyber kill chain phases. We introduce a novel approach, deploying a camouflaged chatterbox application within the honeypot network. This application offers a regular chat interface while periodically tracking attacker activity by enabling periodic log transfers. Deployed for 100 days, our orchestrated honeypot recorded 13,906,945 hits from 4,238 unique IP addresses. Our approach categorizes attackers, discerning varying levels of sophistication, and identifies attacks from Hong Kong with similarities to known Chinese threat groups. This research significantly advances honeypot technology and enhances the understanding of sophisticated threat actors’ strategies in real operating networks.

A Highly Interactive Honeypot-Based Approach to Network Threat Management

In this paper, considering the problem that the common defensive means in the current cyber confrontation often fall into disadvantage, honeypot technology is adopted to turn reactive into proactive to deal with the increasingly serious cyberspace security problem. We address the issue of common defensive measures in current cyber confrontations that frequently lead to disadvantages. To tackle the progressively severe cyberspace security problem, we propose the adoption of honeypot technology to shift from a reactive to a proactive approach. This system uses honeypot technology for active defense, tempting attackers into a predetermined sandbox to observe the attacker’s behavior and attack methods to better protect equipment and information security. During the research, it was found that due to the singularity of traditional honeypots and the limitations of low-interactivity honeypots, the application of honeypot technology has difficulty in achieving the desired protective effect. Therefore, the system adopts a highly interactive honeypot and a modular design idea to distinguish the honeypot environment from the central node of data processing, so that the honeypot can obtain more sufficient information and the honeypot technology can be used more easily. By managing honeypots at the central node, i.e., adding, deleting, and modifying honeypots and other operations, it is easy to maintain and upgrade the system, while reducing the difficulty of using honeypots. The high-interactivity honeypot technology not only attracts attackers into pre-set sandboxes to observe their behavior and attack methods, but also performs a variety of advanced functions, such as network threat analysis, virtualization, vulnerability perception, tracing reinforcement, and camouflage detection. We have conducted a large number of experimental comparisons and proven that our method has significant advantages compared to traditional honeypot technology and provides detailed data support. Our research provides new ideas and effective methods for network security protection.

A Honey pot Implementation for security Enhancement in IOT System using AES and Key management

: Honey pot technology is a trap technology in network defence. It studies and learns the adversary’s attacks by attracting and deceiving attackers and recording their attack behaviours. Target and attack methods to protect real service resources. However, traditional honey pot technology has inherent shortcomings such as static configuration and fixed deployment, and it is very easy to be attacked. Attacker identification bypasses and loses decoy value. Therefore, how to improve the dynamic and deceptive nature of honey pots has become a key issue in the field of honey pots. This paper is the research results in the field of honey pots at home and abroad are sorted out. First, the development history of honey pots is summarized. Then, the key technology of honey pots is the core, and the implementation process, department. It analyzes the method of signature, anti-identification thinking, and the theoretical basis of game; finally, it classifies and narrates the defence results of different honey pots in recent years, and develops the honey pot technology. Development trends are analyzed and stated, aiming at potential security threats, and looking forward to defence applications in emerging areas. In this paper, novel AES algorithm has been developed. In addition key management feature is added which provides more secure for registered users.

Latest Research Progress of Honeypot Technology

Honeypot technology is a network trap in cyber defense. It can attract and deceive attackers and record their attack behavior, so as to study the target and attack means of the adversary and protect real service resources. However, because of the static configuration and the fixed deployment in traditional honeypots, it is as easy as a pie for intruders to identify and escape those traps, which makes them meaningless. Therefore, how to improve the dynamic characteristic and the camouflage performance of honeypot becomes a key problem in the field of honeypot. In this paper, the recent research achievements in honeypot are summarized. Firstly, the development history of honeypot in four stages is summed up. Subsequently, by focusing on the key honeypot mechanism, the analysis on process, deployment, counter-recognition and game theory are carried out. Finally, the achievements of honeypot in different aspects are characterized and the development trends of honeypot technology is depicted.

Game theoretic simulation on the mimicry honeypot

A mimicry honeypot framework based on game theory is presented in our work, which can calculate the equilibrium strategy of the deceptive game using non-cooperative incomplete dynamic game theory, and make decisions for the mimicry framework to deploy the simple service, the honeypot and the fake honeypot. A mimicry prototype is implemented using NS2 platform, and simulation experiments are launched to validate the decision-making result and the deceptive performance of the mimicry honeypot. The empirical study shows that the mimicry honeypot framework based on game theory can be able to influence the equilibrium strategy results by dynamically changing the deployment vector of the mimicry system. It validates that the mimicry honeypot framework has better flexibility, activeness and fraudulence than the traditional honeypot.