honeypot
61811958
HoneyDOC: An Efficient Honeypot Architecture Enabling All Round Design
Honeypots are designed to trap the attacker with the purpose of investigating its malicious behavior. Owing to the increasing variety and sophistication of cyber attacks, how to capture high quality attack data has become a challenge in the context of honeypot area. All round honeypots, which mean a significant improvement in sensibility, countermeasure, and stealth, are necessary to tackle the problem. In this paper, we propose a novel honeypot architecture termed HoneyDOC to support all round honeypot design and implementation. Our HoneyDOC architecture clearly identifies three essential independent and collaborative modules, Decoy, Captor, and Orchestrator. Based on the efficient architecture, a software defined networking enabled honeypot system is designed, which supplies a high programmability for technically sustaining the features for capturing high quality data. A proof of concept system is implemented to validate its feasibility and effectiveness. The experimental results show the benefits by using the proposed architecture compared with the previous honeypot solutions.
IEEE Journal on Selected Areas in Communications
Wenjun Fan Zhihui Du Max Smith-Creasey David Fernandez
195750533
Adaptive Honeypot Engagement through Reinforcement Learning of Semi Markov Decision Processes
A honeynet is a promising active cyber defense mechanism. It reveals the fundamental Indicators of Compromise (IoCs) by luring attackers to conduct adversarial behaviors in a controlled and monitored environment. The active interaction at the honeynet brings a high reward but also introduces high implementation costs and risks of adversarial honeynet exploitation. In this work, we apply infinite horizon Semi Markov Decision Process (SMDP) to characterize a stochastic transition and sojourn time of attackers in the honeynet and quantify the reward risk trade off. In particular, we design adaptive long term engagement policies shown to be risk averse, cost effective, and time efficient. Numerical results have demonstrated that our adaptive engagement policies can quickly attract attackers to the target honeypot and engage them for a sufficiently long period to obtain worthy threat information. Meanwhile, the penetration probability is kept at a low level. The results show that the expected utility is robust against attackers of a large range of persistence and intelligence. Finally, we apply reinforcement learning to the SMDP to solve the curse of modeling. Under a prudent choice of the learning rate and exploration policy, we achieve a quick and robust convergence of the optimal policy and value.
GameSec
Linan Huang Quanyan Zhu
209175252
Honware: A Virtual Honeypot Framework for Capturing CPE and IoT Zero Days
Existing solutions are ineffective in detecting zero day exploits targeting Customer Premise Equipment (CPE) and Internet of Things (IoT) devices. We present honware, a high interaction honeypot framework which can emulate a wide range of devices without any access to the manufacturers' hardware. Honware automatically processes a standard firmware image (as is commonly provided for updates) customises the filesystem and runs the system with a special pre built Linux kernel. It then logs attacker traffic and records which of their actions led to a compromise. We provide an extensive evaluation and show that our framework improves upon existing emulation strategies which are limited in their scalability, and that it is significantly better both in providing network functionality and in emulating the devices' firmware applications a crucial aspect as vulnerabilities are frequently exploited by attackers in 'front end' functionalities such as web interfaces. Honware's design precludes most honeypot fingerprinting attacks, and as its performance is comparable to that of real devices, fingerprinting with timing attacks can be made far from trivial. We provide four case studies in which we demonstrate that honware is capable of rapid deployment to capture the exact details of attacks along with malware samples. In particular we identified a previously unknown attack in which the default DNS for an ipTIME N604R wireless router was changed. We believe that honware is a major contribution towards re balancing the economics of attackers and defenders by reducing the period in which attackers can exploit zero days at Internet scale.
2019 APWG Symposium on Electronic Crime Research (eCrime)
Alexander Vetterl Richard Clayton
59347122
Honeypot Deception Tactics
Honeypots on computer networks are most effective when they use deception to fool cyberadversaries into thinking that they are not actual decoy intelligence collectors. Honeypot deception can be made more effective when applied with variety. We discuss the range of deception tactics of which honeypots can take advantage. Ideas can come from deception theory, and honeypot deceptions can benefit from planning and experimentation.
Ehab Al-Shaer Jinpeng Wei Kevin W Hamlen Cliff X Wang
204230808
A Honeypot with Machine Learning based Detection Framework for defending IoT based Botnet DDoS Attacks
With the tremendous growth of IoT botnet DDoS attacks in recent years, IoT security has now become one of the most concerned topics in the field of network security. A lot of security approaches have been proposed in the area, but they still lack in terms of dealing with newer emerging variants of IoT malware, known as Zero Day Attacks. In this paper, we present a honeypot based approach which uses machine learning techniques for malware detection. The IoT honeypot generated data is used as a dataset for the effective and dynamic training of a machine learning model. The approach can be taken as a productive outset towards combatting Zero Day DDoS Attacks which now has emerged as an open challenge in defending IoT against DDoS Attacks.
2019 3rd International Conference on Trends in Electronics and Informatics (ICOEI)
Ruchi Vishwakarma Ankit Kumar Jain
189825047
Dynamic Distributed Honeypot Based on Blockchain
Honeypot technology can be applied to efficiently attract attackers and exhaust their resources. However, the traditional static honeypot is easy to be recognized by anti honeypot technology. By contrast, most of the dynamic honeypots can simulate the real system in time, thus interacting with an intruder in disguise. In this paper, we employ the dynamic property of honeypot in four kinds of services of our system. However, this dynamic property shows up in a location and identification, indicating that genuine or fake services (honeypots) are changeable in different hosts. Thus, the dynamic property of our system differs from the dynamic honeypot aforementioned. Besides, we adopt the blockchain platform (Ethereum) to decentralize our system and store the port access data by delivering a private chain. To illustrate the effectiveness of our scheme in theory and practice, security analysis, eavesdropping attack, scanning attack, and DoS attack experiments are conducted. The results show that our scheme is valid in safeguarding against network attack.
IEEE Access
Leyi Shi Yongxi Li Tianxu Liu Jia Liu Baoying Shan Honglong Chen
49326208
A survey on Intrusion Detection Systems and Honeypot based proactive security mechanisms in VANETs and VANET Cloud
Abstract Vehicular ad hoc Network (VANET) is an emerging type of Mobile ad hoc Networks (MANETs) with excellent applications in the intelligent traffic system. Applications in VANETs are life critical since human lives are at stake and therefore, interaction among nodes (vehicles) must be established in the most secure manner. To provide security for VANETs, various security measures are designed, the most popular of which is Intrusion Detection Systems (IDSs) IDS has already proved its worth in detection of malicious nodes in traditional networks but applying the IDS in VANET like networks is somehow different and difficult due to its peculiar characteristics such as resource constrained nodes, high mobility of nodes, specific protocols stacks, and standards. This paper presents a brief introduction about the various IDSs, in general, to get the readers well acquainted with the concept of IDS after which an in depth survey of various IDSs that are propounded for VANETs is put forward followed by analyzing and comparing each technique along with merits and demerits. Some basic instructions have also been presented for developing IDSs that have a potential application in VANET and VANET Cloud. Our aim is to identify leading trends, open challenges, and future research directions in the deployment of IDS in VANET. In order to bridge the research gaps in terms of performance, detection rate and overhead, and also to overcome the challenges of existing IDS in literature, a proactive bait based Honeypot optimized IDS system is also proposed with the aim to detect existing and zero day attacks with minimal overhead. Finally, some open research works being carried out in the field is also proposed.
Veh. Commun.
Sparsh Sharma Ajay Kaul
203702113
Automatic Identification of Honeypot Server Using Machine Learning Techniques
Traditional security strategies are powerless when facing novel attacks in the complex network environment, such as advanced persistent threat (APT) Compared with traditional security detection strategies, the honeypot system, especially on the Internet of things research area, is intended to be attacked and automatically monitor potential attacks by analyzing network packages or log files. The researcher can extract exactly threat actor tactics, techniques, and procedures from these data and then generate more effective defense strategies. But for normal security researchers, it is an urgent topic how to improve the honeypot mechanism which could not be recognized by attackers, and silently capture their behaviors. So, they need awesome intelligent techniques to automatically check remotely whether the server runs honeypot service or not. As the rapid progress in honeypot detection using machine learning technologies, the paper proposed a new automatic identification model based on random forest algorithm with three group features: application layer feature, network layer feature, and other system layer feature. The experiment datasets are collected from public known platforms and designed to prove the effectiveness of the proposed model. The experiment results showed that the presented model achieved a high area under curve (AUC) value with 0.93 (area under the receiver operating characteristic curve) which is better than other machine learning algorithms.
Secur. Commun. Networks
Cheng Huang Jiaxuan Han Xing Zhang Jiayong Liu
160010459
SCADA security using SSH honeypot
Industrial Control System (ICS) is a term that refers to control systems in production, transmission and distribution architecture in Smart Grid. These systems can be SCADA (Supervisory Control and Data Acquisition System) and DCS (Distributed Control Systems) ICS have moved from proprietary system to open and standard technologies interconnected with others networks such as Internet. This move to interconnecting ICS with others networks have exposed this system to different attacks and have revealed serious weaknesses. So, these systems must deployed protection measures like IDS, Firewalls, IPS and others. However, detection based on these measures is often based on prior knowledge of the attacks themselves and are not able to study the behavior and techniques used by attackers, which means that new attacks are not detectable by them. So, in order to detect new attacks, understand malicious activities targeting ICS, and analyses attackers' behaviors and techniques used by them, in this article, we use a SSH honeypot tool called Kippo in order to log brute force attacks and shell interaction performed by attackers in order to take attention away in the production server.
NISS19
Amine Belqruch Abdelilah Maach
199187981
Defense Strategies Against Network Attacks in Cyber Physical Systems with Analysis Cost Constraint Based on Honeypot Game Model
Cyber physical system (CPS) is an advanced system that integrats physical processes, computation and communication resources. The security of cyber physical systems has become an active research area in recent years. In this paper, we focus on defensive strategies against network attacks in CPS. We introduce both lowand highinteraction honeypots into CPS as a security management tool deliberately designed to be probed, attacked and compromised. In addition, an analysis resource constraint is introduced for the purpose of optimizing defensive strategies against network attacks in CPS. We study the offensive and defensive interactions of CPS and model the offensive and defensive process as an incomplete information game with the assumption that the defender's analysis resource is unknown to the attacker. We prove the existence of several Bayesian Nash equilibria in the lowand high interaction honeypot game without analysis cost constraints and obtain the attacker's equilibrium strategy firstly. Then, we take the impact of analysis cost on the capture effect of honeypots into consideration and further optimize the defensive strategy by allocating analysis resource between lowand high interaction honeypot with resource constraint. Finally, the proposed method is evaluated through numerical simulation and prove to be effective in obtaining the optimal defensive strategy.
Wen Tian Xiaopeng Ji Weiwei Liu Guangjie Liu Rongru Lin Jiangtao Zhai Yuewei Dai