Honeycomb - Creating Intrusion Detection Signatures Using Honeypots (2003)
Cached
Download Links
| Venue: | In Proceedings of the Second Workshop on Hot Topics in Networks (HotNets-II |
| Citations: | 142 - 2 self |
BibTeX
@INPROCEEDINGS{Kreibich03honeycomb-,
author = {Christian Kreibich and Jon Crowcroft},
title = {Honeycomb - Creating Intrusion Detection Signatures Using Honeypots},
booktitle = {In Proceedings of the Second Workshop on Hot Topics in Networks (HotNets-II},
year = {2003}
}
Years of Citing Articles
Bookmark
 |
 |
 |
 |
 |
 |
OpenURL
Abstract
Abstract — This paper describes a system for automated generation of attack signatures for network intrusion detection systems. Our system applies pattern-matching techniques and protocol conformance checks on multiple levels in the protocol hierarchy to network traffic captured a honeypot system. We present results of running the system on an unprotected cable modem connection for 24 hours. The system successfully created precise traffic signatures that otherwise would have required the skills and time of a security officer to inspect the traffic manually. Index Terms — network intrusion detection, traffic signatures, honeypots, pattern detection, protocol analysis, longest-commonsubstring algorithms, suffix trees. I.
