Improving Exposure of Intrusion Deception System through Implementation of Hybrid Honeypot
Journal: The International Arab Journal of Information Technology (Vol.9, No. 5)Publication Date: 2012-09-01
Authors : Masood Mansoori; Omar Zakaria; Abdullah Gani;
Page : 436-444
Keywords : IDS; server honeypot; client honeypot; and hybrid honeypot.;
Abstract
This paper presents a new design hybrid honeypot to improve the exposure aspect of intrusion deception systems and in particular, research server honeypots. A major attribute in the design of a server honeypot is its passiveness, which allows the honeypot to expose its services and passively wait to be attacked. Although passiveness of a server honeypot simplifies the analysis process by classifying traffics as malicious, however it also lessens its ability to lure attackers through exposure of vulnerable service. As a result it captures smaller amount of data on attacks for analysis. Client honeypot designs, on the other hand, contain modules that actively interact with outside networks, expose vulnerabilities in client side software, and identify malicious content, hosted on webservers. The proposed hybrid system integrates active module concept of a client honeypot into a server honeypot. The active module interacts with webservers utilising a custom crawler and browser, publicises the honeypot's IP address and therefore improves exposure of server honeypot's vulnerable services. The findings presented in this paper show that interaction with webservers improves exposure, and results in significantly higher number of attacks, which in turn, increases the probability of discovering new threats. The findings also characterise most attacks to be worm based and directed at Windows based hosts and services.
Other Latest Articles
- On Handling Real-Time Communications in MAC Protocols
- Location and Non-Location Based Ad-Hoc Routing Protocols under Various Mobility Models: A Comparative Study
- Chromaticity Based Waste Paper Grade Identification
- Entropy Improvement for Fractal Image Coder
- Spatial and Visual Reasoning in Biomedical Education: The Possible Contributions of Anatomical Learning | Biomed Grid
Last modified: 2019-05-14 16:03:54