Review of intrusion detection systems based on honeypot technology
DOI:
https://doi.org/10.18372/2225-5036.18.3453Keywords:
intrusion detection system, virtual honeypot, honeypot, attack detection mechanism, signature, network trafficAbstract
In the paper the review of intrusion detection systems based on honeypot technology was carried out. The comparative description of the generation methods for signatures of intrusion detection systems based on virtual honeypot also was given. These results will be useful for development of new and improvement of existed intrusion detection systems.References
Kyaw K.L.L. Hybrid Honeypot System for Network Security / K.L.L. Kyaw, P. Gyi // World Academy of Science, Engineering and Technology 48
– Mandalay: Mandalay Technological University, 2008.
Balas E. Honeynet data analysis: A technique for correlating sebek and network data / E. Balas // Workshop on Information Assurance and Security United States Military Academy, West Point, NY. – IEEE, 2004.
Hope P. Mastering FreeBSD and OpenBSD Security / P. Hope, Y. Korff, B. Potter. – Ca.: O’Reily Media, 2005. – P.464.
Cox K., Gerg C. Managing Security with Snort and IDS Tools / K. Cox, C. Gerg. – Ca.: O’Reily Media, 2004. – p.288.
Honeytrap – A Dynamic Meta-Honeypot Daemon [Електронний ресурс]: (honeytrap) – Режим доступу: http://honeytrap.carnivore.it/
Nebula – Generating Syntactical Network Intrusion Signatures / Werner T., Fuchs C., Gerhards-Padilla E., Martini P. // Lecture Notes in Computer Science. – B.: Springer Berlin, 2005. – Vol.3245. – P.105-113.
Kreibich C. Honeycomb - creating intrusion detection signatures using honeypots / C. Kreibich, J. Crowcroft // Second Workshop on Hot Topics in Networks (Hotnets II). – Boston, 2003.
Newsome J. Polygraph: Automatically generating signatures for polymorphic worms / J. Newsome, B. Karp, D. Song // Proceedings of the 2005 IEEE Symposium on Security and Privacy. – Washington: IEEE Computer Society, 2005.
Automated worm fingerprinting / Singh S., Estan C., Varghese G., Savage S. // OSDI. – San Diego.: University of California, 2004. – P.45-60.
Yegneswaran V. An architecture for generating semantic-aware signatures / V. Yegneswaran, J.T. Giffin, S.J. Paul Barford // Proceedings of the 14th USENIX Security Symposium, 2005. – P.97-112.
Kim H.A. Autograph: Toward automated, distributed worm signature detection / H.A. Kim, B. Karp // Proceedings of the USENIX Security Symposium, 2004. – P.271-286.
Tang Y. Defending against internet worms: A signature-based approach / Y. Tang, S. Chen // Proceedings of IEEE INFOCOM’05, 2005.
Wang S.S.K. Anomalous payload-based network intrusion detection / S.S.K. Wang // Proceedings of the 7th International Symposium on Recent Advances in Intrusion Detection. – Sophia Antipolis, 2004.
Liang Z. Fast and automated generation of attack signatures: A basis for building self-protecting servers / Z. Liang, R. Sekar // Proceedings of the 12th ACM Conference on Computer and Communications Security (CCS). – Alexandria, 2005.
Smirnov C.T. Dira: Automatic detection, identification, and repair of control-hijacking attacks. / C.T. Smirnov // Proceedings of NDSS05: Network and Distributed System Security Symposium Conference Proceedings. – San Diego, 2005.
Detection of injected, dynamically generated, and obfuscated malicious code / Rabek J.C., Khazan R.I., Lewandowski S.M., Cunningham R.K. // Proceedings of the 2003 ACM workshop on Rapid Malcode. – New York, 2003. – P.76-82.
Crandall J.R. Experiences using minos as a tool for capturing and analyzing novel worms for unknown vulnerabilities / J.R. Crandall, S.F. Wu, F.T. Chong // Proceedings of DIMVA’05, 2005. – P.32-50.
Lam L., Chiueh T. Automatic extraction of accurate application-specific sandboxing policy / L. Lam, T. Chiueh // Lecture Notes in Computer Science. – B.: Springer Berlin, 2004. – Vol.3224. – P.1-20.
Security for structured peer-to-peer overlay networks / Castro M., Druschel P., Ganesh A., Rowstron A., and Wallach D.S.// Proceedings of the 5th Symposium on Operating Systems Design and Implementation (OSDI’02). – Boston, 2002.
Honeystat: Local worm detection using honeypots / Dagon D., Qin X., Gu G., Lee W., Grizzard J.B., Levine J.G., and Owen H.L. // Lecture Notes in Computer Science. – B.: Springer Berlin, 2004. – Vol.3224. – P. 39-58.
