Countermeasure for Detection of Honeypot Deployment

Size: px
Start display at page:

Download "Countermeasure for Detection of Honeypot Deployment"

Transcription

1 Proceedings of the International Conference on Computer and Communication Engineering 2008 May 13-15, 2008 Kuala Lumpur, Malaysia Countermeasure for Detection of Honeypot Deployment Lai-Ming Shiue 1, Shang-Juh Kao 2 1 Department of Applied Mathematics 2 Department of Computer Science and Engineering National Chung-Hsing University, Taiwan Abstract In this paper, a deceptive system, called honeyanole, is developed to escape from honeypot hunting as well as to collect attacking information. In honeyanole, three phases of collection, redirection and deception are implemented. In the collection phase, four types of attacking information are gathered for cross analysis to build up the blacklist. Upon the blacklist being developed, two redirection techniques, layer-2 and layer-3 redirection, are employed to dynamically transmit incoming traffic to a production or a deception server in the redirection phase. Finally, the deception server could transparently capture the attacking behaviors in the deception phase. With honeyanole, we can effectively prevent honeypot deployment from hunting, build an early warning system, and enhance the system defense. I. INTRODUCTION As threats to network security increase with the exponential growth, the traditional defensive systems, such as firewall and intrusion detection systems, is insufficient. Honeypots [1-4], a deceptive approach, are introduced to trap hackers. Without being noticed by hackers, attacking information is gathered and analyzed in order to trace attacking behaviors. There are two approaches to classify honeypots [5-7], depending upon either the deployment purpose or the interactions with the honeypot. Regarding with the purpose of deployment, a honeypot could be constructed for the production or research purpose. Based on the interactions with the honeypot, a honeypot could be either low-interaction or highinteraction. No matter how a honeypot is classified, either by purpose or by interaction, only when the deployment is transparent, honeypot approach is useful. Since the essential task of the honeypot strategy is to make indistinguishable to attackers between a deceptive system and a regular host, how to not expose the honeypot deployment becomes critical. In general, deception detection [8] could be service support detection, connection feature detection, or system level detection. Service support detection [9, 10] launches all kinds of service requests to check for a honeypot. Usually, an emulated service can be easily examined as a deceptive system. Connection feature detection [10] refers to remotely test a target host and collect the transmission features, such as latency, error, and protocol header. Through the connection features analysis, a fabricated operating system or a virtual network interface can easily be discovered. For instance, a high detection rate of recognizing a low-interaction honeypot was reported in [11] by using Neyman-Pearson decision theory to analyze information collected from round trip time of icmp and tcp connections. And, Mukkamala et al [9] demonstrated that high detection accuracy (higher than 95%) can be derived in identifying a honeypot by using SVMs to analyze 49 various features of tcp connections. System level features, such as type of physical devices, type of file systems, and the memory usage of hidden programs, are required to detect [12, 13] a high-interaction honeypot, no matter the real system is deployed at a physical or virtual machine. There already exists some collection tool for high-interaction honeypots, for instance the Sebek [14], which works in the kernel module to monitor system call invocations and record data of interest. In [15], the NoSEBrEak project has shown that Sebek can be detected and disabled. Briefly, the three deception detection techniques for discovering different types of honeypot systems can be listed as in Table /08/$ IEEE 595

2 TABLE I. Interactio n Level DETECTABILITY OF DECEPTION DETECTION METHODS Machine Type Connection Feature Detection Method Service Support low virtual detectable detectable high System Level undetectabl e virtual detectable undetectable detectable physical undetectable undetectable detectable While the development of a honeypot system focuses on the integration and analysis of attacking information, the exposure of honeypot deployment will make the deceptive system to be invalid. A common countermeasure against the deployment exposure is to redirect the connection to avoid directly interacting with a honeypot. The redirection technique is to decompose Internet traffic into two destinations: a production server or a honeypot. In general, the direction of traffic flows is decided upon the intrusion detection engine. In [16], a bait & switch honeypot router is constructed at the network layer and uses network address translation (NAT) to dispatch the traffic flows. However, such a pure layer- 3 redirection could easily slow down non-attacking service connections and the deployment could be revealed via the latency trace, such as via the icmp protocol. In [17], a redirection module in honeypot system at the data link layer is presented to lure suspicious traffic into a honeypot system via changing the MAC address. Unfortunately, when the layer-2 redirection is implemented in a connection oriented network, the sequence number failure due to the reconnection operation makes the honeypot system to be suspicious. In this paper, a deceptive system, called honeyanole, is developed to escape from honeypot hunters as well as to collect attacking information to enhance further defense. In this system, non-attacking service connections and probing connections are monitored and transmitted, while the attacking service connections are transparently redirected to the fabricated system for the attacking process collection. Finally, the system implementation and its evaluation are reported. II. THE HONEYANOLE SYSTEM In honeyanole, both layer-2 and layer-3 redirection mechanisms are employed to dynamically transmit incoming traffic flows for the purpose of resisting the detection of honeypot hunters as well as collecting and analyzing attacking information. We categorize network connections into regular service requests, probe requests, and attacking service requests. Under the layer-2 redirection, regular service connections and probe requests are directed to the real system. In this case, the redirection latency is insignificant, and hence the honeypot is not suspicious to honeypot hunters. Once an attacking service connection is discovered, layer-3 redirection is active and the connection is redirected to the fabricated system. There are three phases in honeyanole: collection phase, redirection phase, and deception phase. The main task of collection phase is to build a blacklist of possible attackers to support the redirection server. As shown in Figure 1, all traffic flows from Internet to production server will be mirrored to the detection module for intrusion inspecting. The information of possible attackers will be gathered by collection module from detection module and other three defensive systems, including the illegal access log, the record of probes, and exchanged defensive information. Mirrored Traffic attacking information from other systems Detection Collection Analysis Figure 1. s inside the collection phase. redirection server Decision After the collection, the alerts of attacking information for eliminating the same attack and incurring a new threat based on alert type, source address, and target address are raised. Then, the analysis module performs the correlation of collected attacking information to predefine attack scenarios, such as network scans, port scans, or vulnerability attacks. Upon finishing the analysis, the decision module would build an orderly list of possible attackers according to temporal information and involved services. Finally, a blacklist is distributed to redirection server dynamically. For redirection, the server with external, internal, and redirection interfaces are designated to connect to Internet, a production network, and a deception server respectively. When an incoming traffic arrives from Internet interface, redirection module will transmit it to a production server or a deception server with the aid of the blacklist. Operational flows of the redirection module can be depicted in Figure

3 Three deception programs, honeyd [20], honeytrap[21] and linux with sebek [14], are deployed as deception servers. In order to validate the feasibility of the honeyanole, several tests in the test environments of direct, bait & switch, and honeyanole were conducted as shown in Figure 4. Apache web server was employed as the production server and Microsoft web application stress tool was adopted to generate http connections from the traffic generator. Figure 2. Operation flows of redirection module. Deception Agent Production Server If an incoming traffic is a probe or its source address does not appear in the blacklist, the layer-2 redirection would forward the traffic to a production server via the internal interface without changing any packet s content. However, if an incoming traffic has its source address appearing in the blacklist, the layer- 3 redirection will take place. With layer-3 redirection, target masquerade changes the target address of incoming packets into the deception server before layer-3 forwarding. And, TTL masquerade adjusts the value of ttl in IP header to conceal from the action of layer-3 forwarding. Similarly, the outgoing packets will be adjusted accordingly. The deception phase is responsible to capture the intrusive processes. With honeyanole, various types of honeypots systems can be deployed as deception servers. Adopting a high-interaction honeypot can obtain more intrusive information and easily suffer from deployment disclosure by system level detections, while a low-interaction honeypot could be discovered by service support detections. How to precisely predict an intrusion, more specifically honeypot detection, is the key feature to deception detection. By combining the above three phases, honeyanole system is built as shown in Figure 3. Therefore, how to build an effective and accurate blacklist is an imperative task. All traffic to production server, including service connections and attacks, are mirrored to detection module to execute an intrusive inspection. The alert generated by the detection module is also the main part of attacking information. Traffic defensive information exchange Black List Detection Collection Redirection Server Collection Server Redirection Decision Analysis Figure 3. The global view of honeyanole. Figure 4. Test case network layout. Deception Server Defensive System III. SYSTEM EVALUATION Following the honeyahole architecture, we carried out the implementation in slackware linux environment. Iptables [18] and snort [19] are employed as the redirection and detection modules respectively. A. Connection Latency Test As for examining connection delay generated by both layer-2 and layer-3 redirections, the first test is to measure the connection latency in various situations. 597

4 598

5 REFERENCES [1] F. Raynal, Y. Berthier, P. Biondi, and D. Kaminsky, "Honeypot Forensics, Part I: Analyzing the Network", IEEE Security & Privacy, vol. 2, pp , Jul-Aug [2] F. R. Raynal, Y. Berthier, P. Biondi, and D. Kaminsky, "Honeypot Forensics, Part II: Analyzing the Compromised Host", Ieee Security & Privacy, vol. 2, pp , Sep-Oct [3] A. Chuvakin, "Honeynets: High Value Security Data", in Network Security. vol. 2003, 2003, pp [4] R. McGrew, "Experiences with Honeypot Systems: Development, Deployment, and Analysis", in HICSS '06. Proceedings of the 39th Annual Hawaii International Conference on 2006, pp. 220a-220a. [5] DFN-CERT, "European Network of Affined Honeypots - Survey on the state-of-the-art", Report Number: D0.1, [6] R. Tber, "A Practical Comparison of Low and High Interactivity Honeypots", in Information Security Institute. vol. Master Australia Queensland University of Technology, 2005, p. 51. [7] H. Artaila, H. Safab, M. Sraja, I. Kuwatlya, and Z. Al-Masria, "A Hybrid Honeypot Framework for Improving Intrusion Detection Systems in Protecting Organizational Networks", Comuters & Security, vol. 25, pp , [8] N. Krawetz, "Anti-honeypot Technology", in IEEE Security & Privacy. vol. 2, 2004, pp [9] S. Mukkamala, K. Yendrapalli, R. Basnet, M. K. Shankarapani, and A. H. Sung, "Detection of Virtual Environments and Low Interaction Honeypots", 2007, pp [10] P. Defibaugh-Chavez, R. Veeraghattam, M. Kannappa, S. Mukkamala, and A. H. Sung, "Network Based Detection of Virtual Environments and Low Interaction Honeypots", in Proceedings of the 2006 IEEE SMC, Workshop on Information Assurance, 2006, pp [11] F. Xinwen, Y. Wei, D. Cheng, T. Xuejun, K. Streff, and S. Graham, "On Recognizing Virtual Honeypots and Countermeasures", 2006, pp [12] T. Holz and F. Raynal, "Detecting Honeypots and Other Suspicious Environments", 2005, pp [13] N. C. Rowe, "Measuring the Effectiveness of Honeypot Counter-Counterdeception", in HICSS '06. Proceedings of the 39th Annual Hawaii International Conference on 2006, pp. 129c-129c. [14] M. A. Davis, "Sebek", ed New York, USA: The Honeynet project, [15] M. Dornseif, T. Holz, and C. N. Klein, "NoSEBrEaK - Attacking Honeynets", 2004, pp [16] L. Carter, "Setting Up a Honeypot Using a Bait and Switch Router": SANS' Information Security Reading Room, [17] Y. Geng, R. Chun-ming, and P. Lei, "A Novel Approach for Redirecting in Honeypot Systems", The Journal of China Universities of Posts and Telecommunications, vol. 12, [18] P. Russell, "iptables", netfilter, [19] M. Roesch, "Snort", Snort Sourcefire, [20] R. Chandran and S. Pakala, "Simulating Networks with Honeyd", [21] Honeytrap:

Second-generation (GenII) honeypots

Second-generation (GenII) honeypots Second-generation (GenII) honeypots Bojan Zdrnja CompSci 725, University of Auckland, Oct 2004. b.zdrnja@auckland.ac.nz Abstract Honeypots are security resources which trap malicious activities, so they

More information

HONEYPOT SECURITY. February 2008. The Government of the Hong Kong Special Administrative Region

HONEYPOT SECURITY. February 2008. The Government of the Hong Kong Special Administrative Region HONEYPOT SECURITY February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in part without

More information

Taxonomy of Hybrid Honeypots

Taxonomy of Hybrid Honeypots 2011 International Conference on Network and Electronics Engineering IPCSIT vol.11 (2011) (2011) IACSIT Press, Singapore Taxonomy of Hybrid Honeypots Hamid Mohammadzadeh.e.n 1, Masood Mansoori 2 and Roza

More information

Catching hackers using a virtual honeynet: A case study

Catching hackers using a virtual honeynet: A case study Catching hackers using a virtual honeynet: A case study D.N. Pasman d.n.pasman@student.utwente.nl ABSTRACT This paper presents an evaluation of honeypots used for gathering information about the methods

More information

Dynamic Honeypot Construction

Dynamic Honeypot Construction Dynamic Honeypot Construction 2nd Annual Alaska Information Assurance Workshop Christopher Hecker U. of Alaska, Fairbanks 9-5-2006 Presentation l Brief Introduction l Project Overview l Future Work l References

More information

Contents. vii. Preface. P ART I THE HONEYNET 1 Chapter 1 The Beginning 3. Chapter 2 Honeypots 17. xix

Contents. vii. Preface. P ART I THE HONEYNET 1 Chapter 1 The Beginning 3. Chapter 2 Honeypots 17. xix Honeynet2_bookTOC.fm Page vii Monday, May 3, 2004 12:00 PM Contents Preface Foreword xix xxvii P ART I THE HONEYNET 1 Chapter 1 The Beginning 3 The Honeynet Project 3 The Information Security Environment

More information

IDS / IPS. James E. Thiel S.W.A.T.

IDS / IPS. James E. Thiel S.W.A.T. IDS / IPS An introduction to intrusion detection and intrusion prevention systems James E. Thiel January 14, 2005 S.W.A.T. Drexel University Overview Intrusion Detection Purpose Types Detection Methods

More information

NETWORK SECURITY (W/LAB) Course Syllabus

NETWORK SECURITY (W/LAB) Course Syllabus 6111 E. Skelly Drive P. O. Box 477200 Tulsa, OK 74147-7200 NETWORK SECURITY (W/LAB) Course Syllabus Course Number: NTWK-0008 OHLAP Credit: Yes OCAS Code: 8131 Course Length: 130 Hours Career Cluster: Information

More information

Firewalls and VPNs. Principles of Information Security, 5th Edition 1

Firewalls and VPNs. Principles of Information Security, 5th Edition 1 Firewalls and VPNs Principles of Information Security, 5th Edition 1 Learning Objectives Upon completion of this material, you should be able to: Understand firewall technology and the various approaches

More information

Network Based Intrusion Detection Using Honey pot Deception

Network Based Intrusion Detection Using Honey pot Deception Network Based Intrusion Detection Using Honey pot Deception Dr.K.V.Kulhalli, S.R.Khot Department of Electronics and Communication Engineering D.Y.Patil College of Engg.& technology, Kolhapur,Maharashtra,India.

More information

Project Proposal Active Honeypot Systems By William Kilgore University of Advancing Technology. Project Proposal 1

Project Proposal Active Honeypot Systems By William Kilgore University of Advancing Technology. Project Proposal 1 Project Proposal Active Honeypot Systems By William Kilgore University of Advancing Technology Project Proposal 1 Project Proposal 2 Abstract Honeypot systems are readily used by organizations large and

More information

How to build and use a Honeypot. Ralph Edward Sutton, Jr. DTEC 6873 Section 01

How to build and use a Honeypot. Ralph Edward Sutton, Jr. DTEC 6873 Section 01 How to build and use a Honeypot By Ralph Edward Sutton, Jr DTEC 6873 Section 01 Abstract Everybody has gotten hacked one way or another when dealing with computers. When I ran across the idea of a honeypot

More information

Implementation of a Department Local Area Network Management System

Implementation of a Department Local Area Network Management System Implementation of a Department Local Area Network Management System I-Ping Hsieh Lai-Ming Shiue Shang-Juh Kao Department of Computer Science Department of Applied Mathematics Department of Computer Science

More information

Advanced Honeypot Architecture for Network Threats Quantification

Advanced Honeypot Architecture for Network Threats Quantification Advanced Honeypot Architecture for Network Threats Quantification Mr. Susheel George Joseph M.C.A, M.Tech, M.Phil(CS) (Associate Professor, Department of M.C.A, Kristu Jyoti College of Management and Technology,

More information

SE 4C03 Winter 2005 Firewall Design Principles. By: Kirk Crane

SE 4C03 Winter 2005 Firewall Design Principles. By: Kirk Crane SE 4C03 Winter 2005 Firewall Design Principles By: Kirk Crane Firewall Design Principles By: Kirk Crane 9810533 Introduction Every network has a security policy that will specify what traffic is allowed

More information

HONEYD (OPEN SOURCE HONEYPOT SOFTWARE)

HONEYD (OPEN SOURCE HONEYPOT SOFTWARE) HONEYD (OPEN SOURCE HONEYPOT SOFTWARE) Author: Avinash Singh Avinash Singh is a Technical Evangelist currently worksing at Appin Technology Lab, Noida. Educational Qualification: B.Tech from Punjab Technical

More information

Autonomous Hybrid Honeypot as the Future of Distributed Computer Systems Security

Autonomous Hybrid Honeypot as the Future of Distributed Computer Systems Security Acta Polytechnica Hungarica Vol. 10, No. 6, 2013 Autonomous Hybrid Honeypot as the Future of Distributed Computer Systems Security Peter Fanfara, Marek Dufala, Ján Radušovský Department of Computers and

More information

Honeypots / honeynets

Honeypots / honeynets Honeypots / honeynets presentatie naam 1 Agenda Honeypots Honeynets Honeywall presentatie naam 2 Traffic Problem: Vast quantities of normal traffic Find suspect bits presentatie naam 3 Honeypot Machine

More information

UNIVERSITY OF BOLTON CREATIVE TECHNOLOGIES COMPUTING AND NETWORK SECURITY SEMESTER TWO EXAMINATIONS 2014/2015 NETWORK SECURITY MODULE NO: CPU6004

UNIVERSITY OF BOLTON CREATIVE TECHNOLOGIES COMPUTING AND NETWORK SECURITY SEMESTER TWO EXAMINATIONS 2014/2015 NETWORK SECURITY MODULE NO: CPU6004 [CRT14] UNIVERSITY OF BOLTON CREATIVE TECHNOLOGIES COMPUTING AND NETWORK SECURITY SEMESTER TWO EXAMINATIONS 2014/2015 NETWORK SECURITY MODULE NO: CPU6004 Date: Wednesday 27 th May 2015 Time: 14:00 16:00

More information

Advancement in Virtualization Based Intrusion Detection System in Cloud Environment

Advancement in Virtualization Based Intrusion Detection System in Cloud Environment Advancement in Virtualization Based Intrusion Detection System in Cloud Environment Jaimin K. Khatri IT Systems and Network Security GTU PG School, Ahmedabad, Gujarat, India Mr. Girish Khilari Senior Consultant,

More information

Advanced Honeypot System for Analysing Network Security

Advanced Honeypot System for Analysing Network Security ISSN: 2347-3215 Volume 2 Number 4 (April-2014) pp. 65-70 www.ijcrar.com Advanced Honeypot System for Analysing Network Security Suruchi Narote 1* and Sandeep Khanna 2 1 Department of Computer Engineering.

More information

Volume 2, Issue 3, March 2014 International Journal of Advance Research in Computer Science and Management Studies

Volume 2, Issue 3, March 2014 International Journal of Advance Research in Computer Science and Management Studies Volume 2, Issue 3, March 2014 International Journal of Advance Research in Computer Science and Management Studies Research Article / Paper / Case Study Available online at: www.ijarcsms.com Web Application

More information

Detection of Virtual Environments and Low Interaction Honeypots

Detection of Virtual Environments and Low Interaction Honeypots Detection of Virtual Environments and Low Interaction Honeypots S. Mukkamala, K. Yendrapalli, R. Basnet, M. K. Shankarapani, A. H. Sung Department of Computer Science Institute for Complex Additive Systems

More information

Banking Security using Honeypot

Banking Security using Honeypot Banking Security using Honeypot Sandeep Chaware D.J.Sanghvi College of Engineering, Mumbai smchaware@gmail.com Abstract New threats are constantly emerging to the security of organization s information

More information

Customized Data Exchange Gateway (DEG) for Automated File Exchange across Networks

Customized Data Exchange Gateway (DEG) for Automated File Exchange across Networks Customized Data Exchange Gateway (DEG) for Automated File Exchange across Networks *Abhishek Vora B. Lakshmi C.V. Srinivas National Remote Sensing Center (NRSC), Indian Space Research Organization (ISRO),

More information

Firewall Firewall August, 2003

Firewall Firewall August, 2003 Firewall August, 2003 1 Firewall and Access Control This product also serves as an Internet firewall, not only does it provide a natural firewall function (Network Address Translation, NAT), but it also

More information

Testing Network Security Using OPNET

Testing Network Security Using OPNET Testing Network Security Using OPNET Agustin Zaballos, Guiomar Corral, Isard Serra, Jaume Abella Enginyeria i Arquitectura La Salle, Universitat Ramon Llull, Spain Paseo Bonanova, 8, 08022 Barcelona Tlf:

More information

Honeynets and Honeypots: Companion Technology for Detection and Response

Honeynets and Honeypots: Companion Technology for Detection and Response Honeynets and Honeypots: Companion Technology for Detection and Response Cristine Hoepers cristine@nic.br NIC BR Security Office NBSO Brazilian Computer Emergency Response Team http://www.nbso.nic.br/

More information

Linux Network Security

Linux Network Security Linux Network Security Course ID SEC220 Course Description This extremely popular class focuses on network security, and makes an excellent companion class to the GL550: Host Security course. Protocols

More information

Securing the system using honeypot in cloud computing environment

Securing the system using honeypot in cloud computing environment Volume: 2, Issue: 4, 172-176 April 2015 www.allsubjectjournal.com e-issn: 2349-4182 p-issn: 2349-5979 Impact Factor: 3.762 M. Phil Research Scholar, Department of Computer Science Vivekanandha College

More information

KASPERSKY DDOS PROTECTION. Discover how Kaspersky Lab defends businesses against DDoS attacks

KASPERSKY DDOS PROTECTION. Discover how Kaspersky Lab defends businesses against DDoS attacks KASPERSKY DDOS PROTECTION Discover how Kaspersky Lab defends businesses against DDoS attacks CYBERCRIMINALS ARE TARGETING BUSINESSES If your business has ever suffered a Distributed Denial of Service (DDoS)

More information

Honey Pots For Network Security

Honey Pots For Network Security Honey Pots For Network Security Submitted by:m.sreeram Regno :Y09CS038 SUBMITTED TO: DEPARTMENT OF ENGLISH VRSEC Date :26/9/2011 1 TABLE OF CONTENTS 1) Abstraction - 1 2)Introduction - 3 3)History of honey

More information

Architecture. The DMZ is a portion of a network that separates a purely internal network from an external network.

Architecture. The DMZ is a portion of a network that separates a purely internal network from an external network. Architecture The policy discussed suggests that the network be partitioned into several parts with guards between the various parts to prevent information from leaking from one part to another. One part

More information

Rules definition for anomaly based intrusion detection

Rules definition for anomaly based intrusion detection Rules definition for anomaly based intrusion detection 2002 By Lubomir Nistor Introduction Intrusion detection systems (IDS) are one of the fastest growing technologies within the security space. Unfortunately,

More information

Intrusion Detection Systems and Supporting Tools. Ian Welch NWEN 405 Week 12

Intrusion Detection Systems and Supporting Tools. Ian Welch NWEN 405 Week 12 Intrusion Detection Systems and Supporting Tools Ian Welch NWEN 405 Week 12 IDS CONCEPTS Firewalls. Intrusion detection systems. Anderson publishes paper outlining security problems 1972 DNS created 1984

More information

Firewalls. Chien-Chung Shen cshen@cis.udel.edu

Firewalls. Chien-Chung Shen cshen@cis.udel.edu Firewalls Chien-Chung Shen cshen@cis.udel.edu The Need for Firewalls Internet connectivity is essential however it creates a threat vs. host-based security services (e.g., intrusion detection), not cost-effective

More information

A Novel Distributed Denial of Service (DDoS) Attacks Discriminating Detection in Flash Crowds

A Novel Distributed Denial of Service (DDoS) Attacks Discriminating Detection in Flash Crowds International Journal of Research Studies in Science, Engineering and Technology Volume 1, Issue 9, December 2014, PP 139-143 ISSN 2349-4751 (Print) & ISSN 2349-476X (Online) A Novel Distributed Denial

More information

[Kapse*, 4.(10): October, 2015] ISSN: 2277-9655 (I2OR), Publication Impact Factor: 3.785

[Kapse*, 4.(10): October, 2015] ISSN: 2277-9655 (I2OR), Publication Impact Factor: 3.785 IJESRT INTERNATIONAL JOURNAL OF ENGINEERING SCIENCES & RESEARCH TECHNOLOGY IDENTIFICATION OF ATTACKERS BY USING SECURITY SERVICES OF HONEYPOT Dinesh S. Kapse*, Prof. Vijay Bagdi * WCC DEPT. A.G.P.C.O.E,

More information

Combining IDS and Honeynet Methods for Improved Detection and Automatic Isolation of Compromised Systems B.Tödtmann, S.Riebach, E.P.

Combining IDS and Honeynet Methods for Improved Detection and Automatic Isolation of Compromised Systems B.Tödtmann, S.Riebach, E.P. Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA05) July 7 th -8 th, 2005, Vienna Combining IDS and Honeynet Methods for Improved Detection and Automatic Isolation of Compromised Systems

More information

Honeypot-Architectures using VMI Techniques

Honeypot-Architectures using VMI Techniques Honeypot-Architectures using VMI Techniques Stefan Floeren Betreuer: Nadine Herold, Stephan Posselt Seminar Future Internet SS2013 Lehrstuhl Netzarchitekturen und Netzdienste Fakultät für Informatik, Technische

More information

CSE 4482 Computer Security Management: Assessment and Forensics. Protection Mechanisms: Firewalls

CSE 4482 Computer Security Management: Assessment and Forensics. Protection Mechanisms: Firewalls CSE 4482 Computer Security Management: Assessment and Forensics Protection Mechanisms: Firewalls Instructor: N. Vlajic, Fall 2013 Required reading: Management of Information Security (MIS), by Whitman

More information

Εmerging Ways to Protect your Network

Εmerging Ways to Protect your Network Εmerging Ways to Protect your Network From Vulnerability Scanning to Real-time Monitoring and Detection of Cyber-attacks Konstantinos Xinidis Software Engineer xinidis@vtripgroup.com Development Dept.,

More information

Honeypots and Honeynets Technologies

Honeypots and Honeynets Technologies New Mexico State University Honeypots and Honeynets Technologies Hussein Al-Azzawi Final Paper CS 579 Special Topics / Computer Security Nov. 27, 2011 Supervised by Mr. Ivan Strnad Table of contents: 1.

More information

DoS: Attack and Defense

DoS: Attack and Defense DoS: Attack and Defense Vincent Tai Sayantan Sengupta COEN 233 Term Project Prof. M. Wang 1 Table of Contents 1. Introduction 4 1.1. Objective 1.2. Problem 1.3. Relation to the class 1.4. Other approaches

More information

Network Forensics: Log Analysis

Network Forensics: Log Analysis Network Forensics: Analysis Richard Baskerville Agenda P Terms & -based Tracing P Application Layer Analysis P Lower Layer Analysis Georgia State University 1 2 Two Important Terms PPromiscuous Mode

More information

DESIGN OF NETWORK SECURITY PROJECTS USING HONEYPOTS *

DESIGN OF NETWORK SECURITY PROJECTS USING HONEYPOTS * DESIGN OF NETWORK SECURITY PROJECTS USING HONEYPOTS * Karthik Sadasivam, Banuprasad Samudrala, T. Andrew Yang University of Houston Clear Lake 2700 Bay Area Blvd., Houston, TX 77058 (281) 283-3835, yang@cl.uh.edu

More information

FIREWALL AND NAT Lecture 7a

FIREWALL AND NAT Lecture 7a FIREWALL AND NAT Lecture 7a COMPSCI 726 Network Defence and Countermeasures Muhammad Rizwan Asghar August 3, 2015 Source of most of slides: University of Twente FIREWALL An integrated collection of security

More information

Demystifying the Myth of Passive Network Discovery and Monitoring Systems

Demystifying the Myth of Passive Network Discovery and Monitoring Systems Demystifying the Myth of Passive Network Discovery and Monitoring Systems Ofir Arkin Chief Technology Officer Insightix Copyright 2012 - All Rights Reserved. This material is proprietary of Insightix.

More information

Linux firewall. Need of firewall Single connection between network Allows restricted traffic between networks Denies un authorized users

Linux firewall. Need of firewall Single connection between network Allows restricted traffic between networks Denies un authorized users Linux firewall Need of firewall Single connection between network Allows restricted traffic between networks Denies un authorized users Linux firewall Linux is a open source operating system and any firewall

More information

Protecting and controlling Virtual LANs by Linux router-firewall

Protecting and controlling Virtual LANs by Linux router-firewall Protecting and controlling Virtual LANs by Linux router-firewall Tihomir Katić Mile Šikić Krešimir Šikić Faculty of Electrical Engineering and Computing University of Zagreb Unska 3, HR 10000 Zagreb, Croatia

More information

Traffic Monitoring : Experience

Traffic Monitoring : Experience Traffic Monitoring : Experience Objectives Lebah Net To understand who and/or what the threats are To understand attacker operation Originating Host Motives (purpose of access) Tools and Techniques Who

More information

CYBER ATTACKS EXPLAINED: PACKET CRAFTING

CYBER ATTACKS EXPLAINED: PACKET CRAFTING CYBER ATTACKS EXPLAINED: PACKET CRAFTING Protect your FOSS-based IT infrastructure from packet crafting by learning more about it. In the previous articles in this series, we explored common infrastructure

More information

Chapter 11 Cloud Application Development

Chapter 11 Cloud Application Development Chapter 11 Cloud Application Development Contents Motivation. Connecting clients to instances through firewalls. Chapter 10 2 Motivation Some of the questions of interest to application developers: How

More information

Intro to Firewalls. Summary

Intro to Firewalls. Summary Topic 3: Lesson 2 Intro to Firewalls Summary Basic questions What is a firewall? What can a firewall do? What is packet filtering? What is proxying? What is stateful packet filtering? Compare network layer

More information

A NOVEL APPROACH FOR PROTECTING EXPOSED INTRANET FROM INTRUSIONS

A NOVEL APPROACH FOR PROTECTING EXPOSED INTRANET FROM INTRUSIONS A NOVEL APPROACH FOR PROTECTING EXPOSED INTRANET FROM INTRUSIONS K.B.Chandradeep Department of Centre for Educational Technology, IIT Kharagpur, Kharagpur, India kbchandradeep@gmail.com ABSTRACT This paper

More information

Intrusion Detection Systems (IDS)

Intrusion Detection Systems (IDS) Intrusion Detection Systems (IDS) What are They and How do They Work? By Wayne T Work Security Gauntlet Consulting 56 Applewood Lane Naugatuck, CT 06770 203.217.5004 Page 1 6/12/2003 1. Introduction Intrusion

More information

An Analysis of Packet Fragmentation Attacks vs. Snort Intrusion Detection System

An Analysis of Packet Fragmentation Attacks vs. Snort Intrusion Detection System An Analysis of Packet Fragmentation Attacks vs. Snort Intrusion Detection System Tian Fu and Te-Shun Chou Department of Technology Systems, East Carolina University Greenville, NC, U.S.A. Abstract. When

More information

Product Overview. Product Family. Product Features. Powerful intrusion detection and monitoring capacity

Product Overview. Product Family. Product Features. Powerful intrusion detection and monitoring capacity NIP IDS Product Overview The Network Intelligent Police (NIP) Intrusion Detection System (IDS) is a new generation of session-based intelligent network IDS developed by Huaweisymantec. Deployed in key

More information

Comparison of Firewall, Intrusion Prevention and Antivirus Technologies

Comparison of Firewall, Intrusion Prevention and Antivirus Technologies White Paper Comparison of Firewall, Intrusion Prevention and Antivirus Technologies How each protects the network Juan Pablo Pereira Technical Marketing Manager Juniper Networks, Inc. 1194 North Mathilda

More information

Foglight NMS Overview

Foglight NMS Overview Page 1 of 5 Foglight NMS Overview Foglight Network Management System (NMS) is a robust and complete network monitoring solution that allows you to thoroughly and efficiently manage your network. It is

More information

Firewalls, Tunnels, and Network Intrusion Detection

Firewalls, Tunnels, and Network Intrusion Detection Firewalls, Tunnels, and Network Intrusion Detection 1 Part 1: Firewall as a Technique to create a virtual security wall separating your organization from the wild west of the public internet 2 1 Firewalls

More information

Firewall Lab using IPTABLES

Firewall Lab using IPTABLES Firewall Lab using IPTABLES PURPOSE In this lab you will explore the Linux firewall iptables. The first part of the lab will describe iptables, then basic commands, followed by some exercises. SOFTWARE

More information

Keywords Intrusion detection system, honeypots, attacker, security. 7 P a g e

Keywords Intrusion detection system, honeypots, attacker, security. 7 P a g e HONEYPOTS IN NETWORK SECURITY Abhishek Sharma Research Scholar Department of Computer Science and Engineering Lovely Professional University (Punjab) - India Abstract Computer Network and Internet is growing

More information

International Journal of Enterprise Computing and Business Systems ISSN (Online) : 2230-8849

International Journal of Enterprise Computing and Business Systems ISSN (Online) : 2230-8849 WINDOWS-BASED APPLICATION AWARE NETWORK INTERCEPTOR Ms. Shalvi Dave [1], Mr. Jimit Mahadevia [2], Prof. Bhushan Trivedi [3] [1] Asst.Prof., MCA Department, IITE, Ahmedabad, INDIA [2] Chief Architect, Elitecore

More information

ForeScout CounterACT. Device Host and Detection Methods. Technology Brief

ForeScout CounterACT. Device Host and Detection Methods. Technology Brief ForeScout CounterACT Device Host and Detection Methods Technology Brief Contents Introduction... 3 The ForeScout Approach... 3 Discovery Methodologies... 4 Passive Monitoring... 4 Passive Authentication...

More information

XPROBE-NG. What s new with upcoming version of the tool. Fyodor Yarochkin Armorize Technologies

XPROBE-NG. What s new with upcoming version of the tool. Fyodor Yarochkin Armorize Technologies XPROBE-NG What s new with upcoming version of the tool Fyodor Yarochkin Armorize Technologies Abstract Attacks trends analysis and network modern discovery requirements lazy scanning, application level

More information

Security Technology: Firewalls and VPNs

Security Technology: Firewalls and VPNs Security Technology: Firewalls and VPNs 1 Learning Objectives Understand firewall technology and the various approaches to firewall implementation Identify the various approaches to remote and dial-up

More information

SOUTHERN POLYTECHNIC STATE UNIVERSITY. Snort and Wireshark. IT-6873 Lab Manual Exercises. Lucas Varner and Trevor Lewis Fall 2013

SOUTHERN POLYTECHNIC STATE UNIVERSITY. Snort and Wireshark. IT-6873 Lab Manual Exercises. Lucas Varner and Trevor Lewis Fall 2013 SOUTHERN POLYTECHNIC STATE UNIVERSITY Snort and Wireshark IT-6873 Lab Manual Exercises Lucas Varner and Trevor Lewis Fall 2013 This document contains instruction manuals for using the tools Wireshark and

More information

FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. Chapter 5 Firewall Planning and Design

FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. Chapter 5 Firewall Planning and Design FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. Chapter 5 Firewall Planning and Design Learning Objectives Identify common misconceptions about firewalls Explain why a firewall

More information

Real-time Network Monitoring and Security Platform for Securing Next-Generation Network. Assoc. Prof. Dr. Sureswaran Ramadass

Real-time Network Monitoring and Security Platform for Securing Next-Generation Network. Assoc. Prof. Dr. Sureswaran Ramadass Real-time Network Monitoring and Security Platform for Securing Next-Generation Network Assoc. Prof. Dr. Sureswaran Ramadass The platform Definition A description of a software framework that makes services

More information

Intrusion Detection Systems

Intrusion Detection Systems Intrusion Detection Systems Advanced Computer Networks 2007 Reinhard Wallner reinhard.wallner@student.tugraz.at Outline Introduction Types of IDS How works an IDS Attacks to IDS Intrusion Prevention Systems

More information

P Principles of Network Forensics P Terms & Log-based Tracing P Application Layer Log Analysis P Lower Layer Log Analysis

P Principles of Network Forensics P Terms & Log-based Tracing P Application Layer Log Analysis P Lower Layer Log Analysis Agenda Richard Baskerville P Principles of P Terms & -based Tracing P Application Layer Analysis P Lower Layer Analysis Georgia State University 1 2 Principles Kim, et al (2004) A fuzzy expert system for

More information

An Anomaly-Based Method for DDoS Attacks Detection using RBF Neural Networks

An Anomaly-Based Method for DDoS Attacks Detection using RBF Neural Networks 2011 International Conference on Network and Electronics Engineering IPCSIT vol.11 (2011) (2011) IACSIT Press, Singapore An Anomaly-Based Method for DDoS Attacks Detection using RBF Neural Networks Reyhaneh

More information

The 5 Phases Every Hacker Must Follow

The 5 Phases Every Hacker Must Follow The 5 Phases Every Hacker Must Follow Originally, to hack meant to possess extraordinary computer skills to extend the limits of computer systems. Hacking required great proficiency. However, today there

More information

Firewalls, Tunnels, and Network Intrusion Detection. Firewalls

Firewalls, Tunnels, and Network Intrusion Detection. Firewalls Firewalls, Tunnels, and Network Intrusion Detection 1 Firewalls A firewall is an integrated collection of security measures designed to prevent unauthorized electronic access to a networked computer system.

More information

The HoneyNet Project Scan Of The Month Scan 27

The HoneyNet Project Scan Of The Month Scan 27 The HoneyNet Project Scan Of The Month Scan 27 23 rd April 2003 Shomiron Das Gupta shomiron@lycos.co.uk 1.0 Scope This month's challenge is a Windows challenge suitable for both beginning and intermediate

More information

Guideline on Firewall

Guideline on Firewall CMSGu2014-02 Mauritian Computer Emergency Response Team CERT-MU SECURITY GUIDELINE 2011-02 Enhancing Cyber Security in Mauritius Guideline on Firewall National Computer Board Mauritius Version 1.0 June

More information

Honeypot as the Intruder Detection System

Honeypot as the Intruder Detection System Honeypot as the Intruder Detection System DAVID MALANIK, LUKAS KOURIL Department of Informatics and Artificial Intelligence Faculty of Applied Informatics, Tomas Bata University in Zlin nam. T. G. Masaryka

More information

Chapter 15. Firewalls, IDS and IPS

Chapter 15. Firewalls, IDS and IPS Chapter 15 Firewalls, IDS and IPS Basic Firewall Operation The firewall is a border firewall. It sits at the boundary between the corporate site and the external Internet. A firewall examines each packet

More information

Network Security Administrator

Network Security Administrator Network Security Administrator Course ID ECC600 Course Description This course looks at the network security in defensive view. The ENSA program is designed to provide fundamental skills needed to analyze

More information

Strategies to Protect Against Distributed Denial of Service (DD

Strategies to Protect Against Distributed Denial of Service (DD Strategies to Protect Against Distributed Denial of Service (DD Table of Contents Strategies to Protect Against Distributed Denial of Service (DDoS) Attacks...1 Introduction...1 Understanding the Basics

More information

Hacking Book 1: Attack Phases. Chapter 1: Introduction to Ethical Hacking

Hacking Book 1: Attack Phases. Chapter 1: Introduction to Ethical Hacking Hacking Book 1: Attack Phases Chapter 1: Introduction to Ethical Hacking Objectives Understand the importance of information security in today s world Understand the elements of security Identify the phases

More information

NAT & IP Masquerade. Internet NETWORK ADDRESS TRANSLATION INTRODUCTION. NAT & IP Masquerade Page 1 of 5. Internal PC 192.168.0.25

NAT & IP Masquerade. Internet NETWORK ADDRESS TRANSLATION INTRODUCTION. NAT & IP Masquerade Page 1 of 5. Internal PC 192.168.0.25 NAT & IP Masquerade Page 1 of 5 INTRODUCTION Pre-requisites TCP/IP IP Address Space NAT & IP Masquerade Protocol version 4 uses a 32 bit IP address. In theory, a 32 bit address space should provide addresses

More information

Which of the following network tools would provide the information on what an attacker is doing to compromise a system? a. Proxy server b.

Which of the following network tools would provide the information on what an attacker is doing to compromise a system? a. Proxy server b. An administrator is trying to secure a network from threats originating outside the network. Which of the following devices provides protection for the DMZ from attacks launched from the Internet? a. Antivirus

More information

XPROBE. Building Efficient Network Discovery Tools. Fyodor Yarochkin

XPROBE. Building Efficient Network Discovery Tools. Fyodor Yarochkin XPROBE Building Efficient Network Discovery Tools Fyodor Yarochkin Outline Introduction Some motivating stories: real-life attacks Efficient network mapping with Lazy Scan mode Layer 7 extensions Scripting

More information

Chapter 1. Product Overview

Chapter 1. Product Overview Chapter 1. Product Overview This chapter outlines the key features of NetDefendOS. About D-Link NetDefendOS, page 14 NetDefendOS Architecture, page 16 NetDefendOS State Engine Packet Flow, page 19 1.1.

More information

Firewalls. Securing Networks. Chapter 3 Part 1 of 4 CA M S Mehta, FCA

Firewalls. Securing Networks. Chapter 3 Part 1 of 4 CA M S Mehta, FCA Firewalls Securing Networks Chapter 3 Part 1 of 4 CA M S Mehta, FCA 1 Firewalls Learning Objectives Task Statements 1.3 Recognise function of Telecommunications and Network security including firewalls,..

More information

Operating Systems Group Distributed Operating Systems Firewalls

Operating Systems Group Distributed Operating Systems Firewalls Operating Systems Group Distributed Operating Systems Firewalls Dresden, 2007-06-13 Agenda Introduction What to protect? Where to intercept? Firewalls: Packet filters Application firewalls Firewall practices

More information

FIREWALL AND NAT Lecture 7b

FIREWALL AND NAT Lecture 7b FIREWALL AND NAT Lecture 7b COMPSCI 726 Network Defence and Countermeasures Muhammad Rizwan Asghar August 1, 2016 Source of most slides: University of Twente 2 FIREWALL An integrated collection of security

More information

HONE: Correlating Host activities to Network communications to produce insight

HONE: Correlating Host activities to Network communications to produce insight HONE: Correlating Host activities to Network communications to produce insight GLENN A. FINK, PH.D. Senior Scientist, Secure Cyber Systems SEAN STORY, PMP Project Manager, Software Engineering & Architectures

More information

JK0-022 CompTIA Academic/E2C Security+ Certification Exam CompTIA

JK0-022 CompTIA Academic/E2C Security+ Certification Exam CompTIA JK0-022 CompTIA Academic/E2C Security+ Certification Exam CompTIA To purchase Full version of Practice exam click below; http://www.certshome.com/jk0-022-practice-test.html FOR CompTIA JK0-022 Exam Candidates

More information

Lesson 5: Network perimeter security

Lesson 5: Network perimeter security Lesson 5: Network perimeter security Alejandro Ramos Fraile aramosf@sia.es Tiger Team Manager (SIA company) Security Consulting (CISSP, CISA) Perimeter Security The architecture and elements that provide

More information

Network Address Translation (NAT)

Network Address Translation (NAT) Network Address Translation (NAT) Relates to Lab 7. Module about private networks and NAT. Taken from http://www.cs.virginia.edu/~itlab/ book/slides/module17-nat.ppt 1 Private Network Private IP network

More information

CS 356 Lecture 17 and 18 Intrusion Detection. Spring 2013

CS 356 Lecture 17 and 18 Intrusion Detection. Spring 2013 CS 356 Lecture 17 and 18 Intrusion Detection Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists

More information

Development of an Educational Data Acquisition System to Profile Cyber Attacks

Development of an Educational Data Acquisition System to Profile Cyber Attacks Session ENT 103-056 Development of an Educational Data Acquisition System to Profile Cyber Attacks Philip J Lunsford II, Erol Ozan, Lee Toderick, Tijjani Mohammed East Carolina University lunsfordp@ecu.edu

More information

PROTECTING INFORMATION SYSTEMS WITH FIREWALLS: REVISED GUIDELINES ON FIREWALL TECHNOLOGIES AND POLICIES

PROTECTING INFORMATION SYSTEMS WITH FIREWALLS: REVISED GUIDELINES ON FIREWALL TECHNOLOGIES AND POLICIES PROTECTING INFORMATION SYSTEMS WITH FIREWALLS: REVISED GUIDELINES ON FIREWALL TECHNOLOGIES AND POLICIES Shirley Radack, Editor Computer Security Division Information Technology Laboratory National Institute

More information

Intrusion Detection Systems with Correlation Capabilities

Intrusion Detection Systems with Correlation Capabilities Intrusion Detection Systems with Correlation Capabilities Daniel Johansson danjo133@student.liu.se Pär Andersson paran213@student.liu.se Abstract Alert correlation in network intrusion detection systems

More information

Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur

Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur Module No. # 01 Lecture No. # 40 Firewalls and Intrusion

More information

INTRUSION DETECTION SYSTEMS and Network Security

INTRUSION DETECTION SYSTEMS and Network Security INTRUSION DETECTION SYSTEMS and Network Security Intrusion Detection System IDS A layered network security approach starts with : A well secured system which starts with: Up-to-date application and OS

More information

Networking for Caribbean Development

Networking for Caribbean Development Networking for Caribbean Development BELIZE NOV 2 NOV 6, 2015 w w w. c a r i b n o g. o r g N E T W O R K I N G F O R C A R I B B E A N D E V E L O P M E N T BELIZE NOV 2 NOV 6, 2015 w w w. c a r i b n

More information