Honeypot Implementation in a Cloud Environment

Stefan Machmeier

2024-07-17

Abstract:In this age of digitalization, Internet services face more attacks than ever. An attacker's objective is to exploit systems and use them for malicious purposes. Such efforts are rising as vulnerable systems can be discovered and compromised through Internet-wide scanning. One known methodology besides traditional security leverages is to learn from those who attack it. A honeypot helps to collect information about an attacker by pretending to be a vulnerable target. Thus, how honeypots can contribute to a more secure infrastructure makes an interesting topic of research. This thesis will present a honeypot solution to investigate malicious activities in heiCLOUD and show that attacks have increased significantly. To detect attackers in restricted network zones at Heidelberg University, a new concept to discover leaks in the firewall will be created. Furthermore, to consider an attacker's point of view, a method for detecting honeypots at the transport level will be introduced. Lastly, a customized OpenSSH server that works as an intermediary instance will be presented to mitigate these efforts.

Cryptography and Security

What problem does this paper attempt to address?

The paper attempts to address the issue of how to enhance network security using honeypot technology in a cloud computing environment. Specifically, the paper explores the following aspects:

1. **Application of Honeypots in Cloud Environments**: The study investigates how to deploy a honeypot system in Heidelberg University's cloud service heiCLOUD and analyzes the collected data to assess whether honeypots can effectively improve the security of cloud infrastructure.

2. **Network Firewall Vulnerability Detection**: By deploying a honeypot-like connection detection tool in the campus network, potential vulnerabilities in the firewall are discovered and fixed, thereby enhancing the security of the university's internal network.

3. **Detecting Honeypots from an Attacker's Perspective**: The paper introduces methods for detecting honeypots at the transport layer from an attacker's viewpoint to better understand the challenges that honeypots may face.

4. **Mitigating Honeypot Fingerprinting Activities**: A solution is proposed to mitigate the impact of the aforementioned honeypot detection methods, thereby better concealing the presence of honeypots.

In summary, the core of this master's thesis lies in exploring the application of honeypot technology in modern cloud computing environments and its practical contributions to network security, while also proposing new insights and improvements for honeypot technology.