Abstract:As active network defence systems, honeypots are commonly used as a decoy to inspect attackers and their attack tactics in order to improve the cybersecurity infrastructure of an organisation. A honeypot may be successful provided that it disguises its identity. However, cyberattackers continuously endeavour to discover honeypots for evading any deception and bolstering their attacks. Active fingerprinting attack is one such technique that may be used to discover honeypots by sending specially designed traffic. Preventing a fingerprinting attack is possible but doing that may hinder the process of dealing with the attackers, counteracting the purpose of a honeypot. Instead, detecting an attempted fingerprinting attack in real-time can enhance a honeypots capability, uninterruptedly managing any immediate consequences and preventing the honeypot being identified. Nevertheless, it is difficult to detect and predict an attempted fingerprinting attack due to the challenge of isolating it from other similar attacks, particularly when imprecise observations are involved in the monitoring of the traffic. Dynamic fuzzy rule interpolation (D-FRI) enables an adaptive approach for effective reasoning with such situations by exploiting the best of both inference and interpolation. The dynamic rules produced by D-FRI facilitate approximate reasoning with perpetual changes that often occur in this type of application, where dynamic rules are required to cover new network conditions. This paper proposes a D-FRI-Honeypot, an enhanced honeypot running D-FRI framework in conjunction with Principal Component Analysis, to detect and predict an attempted fingerprinting attack on honeypots. This D-FRI-Honeypot works with a sparse rule base but is able to detect active fingerprinting attacks when it does not find any matching rules. Also, it learns from current network conditions and offers a dynamically enriched rule base to support more precise detection. This D-FRI-Honeypot is tested against five popular fingerprinting tools (namely, Nmap, Xprobe2, NetScanTools Pro, SinFP3 and Nessus), to demonstrate its successful applications.

Dynamic Forensics Based on Intrusion Tolerance.

Modeling and Analyzing Dynamic Forensics System Based on Intrusion Tolerance

Self-adaptive Mechanism of Dynamic Forensics

A Dynamic Forensics Model Based on Intrusion Detection System

Hybrid Intrusion Detection System for Complicated Network

A Dynamic Intrusion Detection System Capable of Detecting Unknown Attacks

Honeynet based distributed adaptive network forensics and active real time investigation.

Design and Implementation of Dynamic Computer Forensics System Based on Network

A New Multi-Function System to Deal with Hacker Intrusion

Distributed Agent-Based Real Time Network Intrusion Forensics System Architecture Design

A new model of immune-based network surveillance and dynamic computer forensics

An Intrusion-Tolerant Model Based on Dynamic Threshold Mechanism

A Transductive Scheme Based Inference Techniques for Network Forensic Analysis

Research on Dynamic Adaptive Intrusion Detection Model

DDCFS: A Distributed Dynamic Computer Forensic System Based on Network

A New Dynamic Security Defense System Based on TCP_REPAIR and Deep Learning

A new model for dynamic intrusion detection

Proactive Forensics Method Based on Intrusion Detection System

Research on Intrusion Event Reconstruction Technology of Computer Intrusion Forensic

A Case Study: Using Architectural Features to Improve Sophisticated Denial-Of-Service Attack Detections

D-FRI-Honeypot: A Secure Sting Operation for Hacking the Hackers Using Dynamic Fuzzy Rule Interpolation