A proposal for securing a large-scale high-interaction honeypot - Archive ouverte HAL Access content directly
Conference Papers Year : 2008

A proposal for securing a large-scale high-interaction honeypot

Abstract

This paper presents the design of a secured high-interaction honeypot. The challenge is to have a honeypot that welcomes attackers, allows userland malicious activities but prevents from system corruption. The honeypot must be scalable to authorize a large amount of malicious activities and to analyze those activities efficiently. The hardening of the honeypot is proposed for two kinds of host. The first class prevents system corruption and has never to be reinstalled. The second class assumes system corruptions but easy reinstallation is available. A first cluster enables to deploy a wide range of honeypots and security sensors. A second cluster provides an efficient auditing facility. The solution is totally based on open source software and has been validated during one year. A statistical analysis shows the efficiency of the different sensors. Origin and destination of attacks are given. Moreover, the complementarities of the sensors are discussed. Ongoing works focus on recognition of complex malicious activities using a correlation grid.
No file

Dates and versions

hal-00447542 , version 1 (15-01-2010)

Identifiers

  • HAL Id : hal-00447542 , version 1

Cite

Jérémy Briffaut, Jean-François Lalande, Christian Toinard. A proposal for securing a large-scale high-interaction honeypot. Workshop on Security and High Performance Computing Systems, Jun 2008, Cyprus, Cyprus. pp.206-212. ⟨hal-00447542⟩
102 View
0 Download

Share

Gmail Mastodon Facebook X LinkedIn More