A proposal for securing a large-scale high-interaction honeypot - CaSciModOT (calcul scientifique et modelisation Orleans-Tours) Accéder directement au contenu
Communication Dans Un Congrès Année : 2008

A proposal for securing a large-scale high-interaction honeypot

Résumé

This paper presents the design of a secured high-interaction honeypot. The challenge is to have a honeypot that welcomes attackers, allows userland malicious activities but prevents from system corruption. The honeypot must be scalable to authorize a large amount of malicious activities and to analyze those activities efficiently. The hardening of the honeypot is proposed for two kinds of host. The first class prevents system corruption and has never to be reinstalled. The second class assumes system corruptions but easy reinstallation is available. A first cluster enables to deploy a wide range of honeypots and security sensors. A second cluster provides an efficient auditing facility. The solution is totally based on open source software and has been validated during one year. A statistical analysis shows the efficiency of the different sensors. Origin and destination of attacks are given. Moreover, the complementarities of the sensors are discussed. Ongoing works focus on recognition of complex malicious activities using a correlation grid.
Fichier non déposé

Dates et versions

hal-00447542 , version 1 (15-01-2010)

Identifiants

  • HAL Id : hal-00447542 , version 1

Citer

Jérémy Briffaut, Jean-François Lalande, Christian Toinard. A proposal for securing a large-scale high-interaction honeypot. Workshop on Security and High Performance Computing Systems, Jun 2008, Cyprus, Cyprus. pp.206-212. ⟨hal-00447542⟩
97 Consultations
0 Téléchargements

Partager

Gmail Facebook X LinkedIn More