Modern virtual decoy systems based on honeypot technology
DOI:
https://doi.org/10.18372/2410-7840.14.3398Keywords:
virtual decoy, honeypot technology, intrusion detection, honeynet, feature principle of the classificationAbstract
In the article the analysis of existed virtual decoy systems based on honeypot technology was carried out. The analysis showed the evolution of honeypot systems from Low-Interaction Honeypots to modern Gen III Honeynets and pointed to the disadvantages of existed solutions. In addition the classification of honeypot systems by the feature principle was fulfilled. Later these results can be used to develop honeypot systems for efficiency increasing of information security incident management systems.References
Know Your Enemy: Learning about Security Threats / Honeynet Project. — NY.: Addison-Wesley Professional, 2004. — 800 p.
Stoll C. Cuckoo’s Egg / С. Stoll. — NY : Pocket, 1990. — 356 p.
Cheswick B. An Evening with Berferd In Which a Cracker is Lured, Endured, and Studied / B. Cheswick. — NY : Management Analytics and Others, 1995. — 147 p.
Spitzner L. Honeypots: Tracking Hackers / L. Spitzner. — NY : Addison-Wesley Professional, 2002. — 480 p.
Provos N. Virtual Honeypots: From Botnet Tracking to Intrusion Detection. — NY : Addison-Wesley Professional, 2007. — 440 p.
Honeynet Project Blog [Електр. ресурс]: (Blog) // The Honeynet Project. — Режим доступу: http://www.honeynet.org (04.09.2012).
A Framework for Deception / Cohen F., Lambert D., Preston C., Berry N., Stewart C., Thomas E. — Tech. Report, 2001.
Balas E., Viecco C. Towards a Third Generation Data Capture Architecture for Honeynets // Workshop on Information Assurance and Security US Military Academy, West Point, NY. — IEEE, 2005.
Roesch M. Snort – lightweight instrusion detection for networks / M. Roesch. — LISA'99 Systems Admistration Conference, 1999.
LaBrea: «Sticky» Honeypot and IDS [Електр. ресурс]: (Labrea Tarpit Project) // Labrea. — Режим доступу: http://labrea.sourceforge.net (04.09.2012).
Hammer R. Enhancing IDS using, Tiny Honeypot / R. Hammer. — SANS Institute, 2006.
The Deception Toolkit [Електр. ресурс]: (The Deception Toolkit Home Page and Mailing List) // Fred Cohen & Associates. — Режим доступу: http://www.all.net/dtk/dtk.html (04.09.2012).
Diebold P. A Honeypot Architecture for Detecting and Analyzing Unknown Network Attacks / P. Diebold, A. Hess, G. Schafer // In Proc. Of 14th Kommunikation in Verteilen Systemen 2005. —Kaiserslautern: Technische Universitat Berlin, 2005.
Thakar U., Varma S., Ramani A. HoneyAnalyzer – Analysis and Extraction of Intrusion Detection Patterns & Signatures Using Honeypot // The Second International Conference on Innovations in Information Technology (IIT’05). — Indore: Institute of Technology and Science, 2005.
Noordin M. Honeypots Revealed / M. Noordin // SecurityDocs.com. — 2004.
Технология Honeypot, Часть 1: Назначение Honeypot. [Електр. ресурс] — Режим доступу: http://www.securitylab.ru/analytics/275420.php (04.09.2012).
Технология Honeypot. Часть 2: Классификация Honeypot. [Електр. ресурс] — Режим доступу: http://www.securitylab.ru/analytics/275775.php (04.09.2012).
Технология Honeypot. Часть 3: Обзор существующих Honeypot. [Електр. ресурс] — Режим доступу: http://www.securitylab.ru/contest/283103.php (04.09.2012).
Grimes R. Honeypots for Windows / R. Grimes. — W. : APress, 2005. — p. 424.
Построение виртуальных ловушек. [Електр. ресурс] — Режим доступу: http://www.securitylab.ru/analytics/216223.php (04.09.2012).
Specter: a Commercial Honeypot Solution for Windows, by Lance Spitzner. [Електр. ресурс] — Режим доступу: http://www.securityfocus.com/infocus/1683 (04.09.2012).
Wichersky G. Medium Interaction Honeypots / G. Wichersky // Workshop on Information Assurance and Security United States Military Academy, West Point, NY. — IEEE, 2006.
Honeyd – Network Rhapsody for You, honeyd devoted site. [Електр. ресурс] — Режим доступу: http://www.citi.umich.edu/u/provos/honeyd (04.09.2012).
De Andrade M. Mechanism for Automatic Digital Evidence Collection on High-Interaction // Workshop on Inf. Assurance and Security US Military Academy, West Point, NY. — IEEE, 2004.
Recourse Tech. ManTrap 3.0 [Електр. ресурс]: (Tech. Industry) // Software Magazine. — Режим доступу: http://findarticles.com/p/articles/mi_m0SMG/is_2_22/ai_91087662 (04.09.2012).
Лаурент О. Борьба со спамом с помощью системы Honeypot: Часть 1 / О. Лаурент [Електр. ресурс] — Режим доступу: http://www.securitylab.ru/analytics/216335.php (04.09.2012).
Лаурент О. Борьба со спамом с помощью системы Honeypot: Часть 2 / О. Лаурент [Електр. ресурс] — Режим доступу: http://www.securitylab.ru/analytics/216343.php (04.09.2012).
Deal R. Router Firewall Security / R. Deal. — SF. : Cisco Press, 2004. — p. 912.
Honeywall project site [Електр. ресурс]: (Honeywall – Trac) // The Honeynet Project — Режим доступу: https://projects.honeynet.org/honey-wall (04.09.2012).
Argus and Infiniband [Електр. ресурс]: (ARGUS – Auditing Network Activity) // QoSient — Режим доступу: http://www.qosient.com/argus (04.09.2012).
What is p0f [Електр. ресурс]: (the new p0f) // lcamtuf.coredump.cx — Режим доступу: http://lcamtuf.coredump.cx/p0f.shtml (04.09.2012).
Balas E. Honeynet data analysis: A technique for correlating sebek and network data / E. Balas // Workshop on Information Assurance and Security US Military Academy, West Point, NY. — IEEE, 2004.
Хусни. Метод разработки средств автоматизации и проектирования сетей приманок : автореф. дис. на соискание науч. степени канд. техн. наук : спец. 05.13.19 «Методы и системы защиты информации, информационная безопасность» / Хусни. — СПб., 2010. — 17 с.
Тимошик Н.П. Вдосконалення принципів побудови та функціонування приманок в задачах захисту комп’ютерних систем та мереж : автореф. дис. на здобуття наук. ступеня канд. техн. наук : спец. 05.13.05 «Комп’ютерні системи та компоненти» / Н.П. Тимошик. — Львів, 2010. — 22 с.
Downloads
Published
Issue
Section
License
Authors who publish with this journal agree to the following terms:- Authors retain copyright and grant the journal right of first publication with the work simultaneously licensed under a Creative Commons Attribution License that allows others to share the work with an acknowledgement of the work's authorship and initial publication in this journal.
- Authors are able to enter into separate, additional contractual arrangements for the non-exclusive distribution of the journal's published version of the work (e.g., post it to an institutional repository or publish it in a book), with an acknowledgement of its initial publication in this journal.
- Authors are permitted and encouraged to post their work online (e.g., in institutional repositories or on their website) prior to and during the submission process, as it can lead to productive exchanges, as well as earlier and greater citation of published work (See The Effect of Open Access).
