Honeypot forensics for system and network SIEM design - Archive ouverte HAL Access content directly
Book Sections Year : 2013

Honeypot forensics for system and network SIEM design


This chapter presents forensic investigations of cyber attackers' activities on a large scale honeypot and shows how these methodologies can be integrated into an SIEM. The chapter describes our high interaction honeypot and analyzes the illegal activities performed by attackers on the basis of the data collected over two years of attacks: logged sessions, intrusion detection system alerts, mandatory access control system alerts. The empirical study of these illegal activities has allowed us to understand the global motivations of the attackers, their technical skills, the geographical location of the attackers and their targets. A generic method is presented that has enabled us to rebuild the illegal activities using correlation techniques operating on system and network events. Monitoring the network and the operations occurring on each system has provided precise and high level characterization of attacks. Finally, the chapter explains how network and system methods for forensics can be integrated into an SIEM in order to more accurately monitor the security of a pool of hosts.
No file

Dates and versions

hal-00677340 , version 1 (08-03-2012)


  • HAL Id : hal-00677340 , version 1


Jérémy Briffaut, Patrice Clemente, Jean-François Lalande, Jonathan Rouzaud-Cornabas. Honeypot forensics for system and network SIEM design. Guillermo Suárez de Tangil and Esther Palomar. Advances in Security Information Management: Perceptions and Outcomes, Nova Science Publishers, pp.181-216, 2013, Computer Science, Technology and Applications, Computer Networks, 978-1-62417-221-2. ⟨hal-00677340⟩
316 View
0 Download


Gmail Mastodon Facebook X LinkedIn More