Abstract:Effective network security administration depends to a great extent on having accurate, concise, high-quality information about malicious activity in one's network. Honeynets can potentially provide such detailed information, but the volume and diversity of this data can prove overwhelming. We explore ways to integrate honeypot data into daily network security monitoring with a goal of sufficiently classifying and summarizing the data to provide ongoing "situational awareness." We present such a system, built using the Bro network intrusion detection system coupled with statistical analysis of numerous honeynet "events", and discuss experiences drawn from many months of operation. In particular, we develop methodologies by which sites receiving such probes can infer-using purely local observation-in format ion about the probing activity: What scanning strategies does the probing employ? Is this an attack that specifically targets the site, or is the site only incidentally probed as part of a larger, indiscriminant attack? One key aspect of this environment is its ability to provide insight into large-scale events. We look at the problem of accurately classifying botnet sweeps and worm outbreaks, which turns out to be difficult to grapple with due to the high dimensionality of such incidents. Using datasets collected during a number of these events, we explore the utility of several analysis methods, finding that when used together they show good potential for contributing towards effective Situational awareness. Our analysis draws upon extensive honeynet data to explore the prevalence of different types of scanning, including properties, such as trend, uniformity, coordination, and darknet-avoidance. In addition, we design schemes to extrapolate the global properties of scanning events (e.g., total population and target scope) as inferred from the limited local view of a honeynet. Cross-validating with data from DShield shows that such inferences exhibit promising accuracy.

Honeypot Deployment in Broadband Networks

Honeypot Deployment Experience at IIT Kanpur

An IoT Honeynet Based on Multiport Honeypots for Capturing IoT Attacks

Security Orchestration, Automation, and Response Engine for Deployment of Behavioural Honeypots

Brief Industry Paper: Catching IoT Malware in the Wild Using HoneyIoT

What are Attackers after on IoT Devices? An approach based on a multi-phased multi-faceted IoT honeypot ecosystem and data clustering

Stories from a Customized Honeypot for the IoT

A First Step Towards Understanding Real-world Attacks on IoT Devices

Containerized cloud-based honeypot deception for tracking attackers

HoneyIoT: Adaptive High-Interaction Honeypot for IoT Devices Through Reinforcement Learning

A Survey of Honeypots and Honeynets for Internet of Things, Industrial Internet of Things, and Cyber-Physical Systems

Employing Honeynets For Network Situational Awareness

Securing a Small Network by using Raspberry Pi Honeypot

Analysis of Honeypot Deployment

A decentralized honeypot for IoT Protocols based on Android devices

Deployment of IoT-based honeynet model

Strategic Deployment of Honeypots in Blockchain-based IoT Systems

Lessons Learned from the deployment of a high-interaction honeypot

Nepenthes Honeypots based Botnet Detection

Analyzing IoT-Based Botnet Malware Activity with Distributed Low Interaction Honeypots

AIIPot: Adaptive Intelligent-Interaction Honeypot for IoT Devices