Digital evidence in virtual honeynets based on operating system level virtualization

Size: px

Start display at page:

Download "Digital evidence in virtual honeynets based on operating system level virtualization"

Diane Shepherd
8 years ago
Views:

1 Digital evidence in virtual honeynets based on operating system level virtualization Security and Protection of Information 2013, , Brno Pavol Sokol, Peter Pisarčík

2 2 Outline 1) Introduction 2) Honeynet based on OS level virtualization 3) Network sensors 4) Implementation of network sensors

3 Honeypots and honeynets 3 Honeypot is a computer system purpose of logging and studying attacks Honeynet is network of honeypots Data Control Data Capture Data Collection Data Analysis

4 4 Virtualization and virtual honeynets Virtualization - multiple virtual machines on a single physical machine There are different levels of virtualization such as: full virtualization, paravirtualization and operating system (OS) level virtualization Virtual honeynet - complete honeynet running on a single computer in virtual environment

5 Operating system level virtualization the kernel of the operating system allows for multiple isolated virtual environments. Advantages of this method are: usually minimal or no overhead, high performance, dynamic resource allocation and best scalability 5 OpenVZ FreeBSD Jail Disadvantages of this method: guest and host operating system - the same kernel

6 OpenVZ and FreeBSD jail in process of data collection 6 Direct access to file system Using virtual network interface. I/O through one system kernel. Access to all processes Direct access to the instructions

7 7 Virtual honeynet based on OS level virtualization

8 Network sensors 8 network data incoming from and outgoing to a honeynet core interface implementation in four phases Proposed four network sensor types: First kernel module. Second kernel module. Integration capture routine into the network card driver. Integration capture routine into the kernel source code.

9 9 Implementation of network sensors dynamic kernel module main aim of kernel module is: 1) virtual network interface - HNET (step 1) 2) data store (step 2) a) I/O entry point in PROCFS b) creation of own filesystem

10 10 Step 1 virtual network interface - HNET The same in both sensor types HnetX Data receiving Network Bridge link the real external honeynet interface and proposed virtual interface. Access all data

11 11 Step 2 data store in first sensor Data storage stored in a special queue (size integer) Access to data via I/O entry point at the root of the directory structure in PROCFS /honeynet/data Destructive reading Control writing an integer value into the file "data". value between 0 and n - number of records number 0 - deletion of the queue. Value n - maximum size of the queue

12 12 Data flow in first type of network sensor

13 13 Step 2 data store in second sensor Data storage stored in a structure of proposed and implemented file system dynamically allocated structures in kernel memory. Size parameter Each memory block- File Access to data read the directory structure read the file contents

14 14 Data flow in second type of network sensor

15 Conclusion and future work four types of network sensors for digital evidence capturing and collecting the implementation of first and second type of network sensor. 15 For future research: implementation of 3 rd and 4 th type of network sensor implementation of other sensors (e.g. file system)

16 Thank you for your attention! Questions?

Securing your Virtual Datacenter. Part 1: Preventing, Mitigating Privilege Escalation

Securing your Virtual Datacenter Part 1: Preventing, Mitigating Privilege Escalation Before We Start... Today's discussion is by no means an exhaustive discussion of the security implications of virtualization