A Virtual Honeypot Framework

DMCA

A Virtual Honeypot Framework (2004)

Cached

Download Links

Other Repositories/Bibliography

DBLP

by Niels Provos

Venue:	In Proceedings of the 13th USENIX Security Symposium
Citations:	247 - 5 self

BibTeX

@INPROCEEDINGS{Provos04avirtual,
    author = {Niels Provos},
    title = {A Virtual Honeypot Framework},
    booktitle = {In Proceedings of the 13th USENIX Security Symposium},
    year = {2004},
    pages = {1--14}
}

OpenURL

Abstract

A honeypot is a closely monitored network decoy serving several purposes: it can distract adversaries from more valuable machines on a network, can provide early warning about new attack and exploitation trends, or allow in-depth examination of adversaries during and after exploitation of a honeypot. Deploying a physical honeypot is often time intensive and expensive as different operating systems require specialized hardware and every honeypot requires its own physical system. This paper presents Honeyd, a framework for virtual honeypots that simulates virtual computer systems at the network level. The simulated computer systems appear to run on unallocated network addresses. To deceive network fingerprinting tools, Honeyd simulates the networking stack of different operating systems and can provide arbitrary routing topologies and services for an arbitrary number of virtual systems. This paper discusses Honeyd’s design and shows how the Honeyd framework helps in many areas of system security, e.g. detecting and disabling worms, distracting adversaries, or preventing the spread of spam email.

Keyphrases

virtual honeypot framework early warning honeyd design exploitation trend network level valuable machine honeyd framework monitored network decoy arbitrary number deceive network fingerprinting tool virtual computer system networking stack specialized hardware many area simulated computer system new attack virtual honeypot physical honeypot system security several purpose disabling worm unallocated network address arbitrary routing topology in-depth examination physical system spam email virtual system

DMCA