<?xml version="1.0" encoding="utf-8"?>
<TEI xmlns="http://www.tei-c.org/ns/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hal="http://hal.archives-ouvertes.fr/" xmlns:gml="http://www.opengis.net/gml/3.3/" xmlns:gmlce="http://www.opengis.net/gml/3.3/ce" version="1.1" xsi:schemaLocation="http://www.tei-c.org/ns/1.0 http://api.archives-ouvertes.fr/documents/aofr-sword.xsd">
  <teiHeader>
    <fileDesc>
      <titleStmt>
        <title>HAL TEI export of hal-00762596</title>
      </titleStmt>
      <publicationStmt>
        <distributor>CCSD</distributor>
        <availability status="restricted">
          <licence target="https://creativecommons.org/publicdomain/zero/1.0/">CC0 1.0 - Universal</licence>
        </availability>
        <date when="2026-05-19T10:25:00+02:00"/>
      </publicationStmt>
      <sourceDesc>
        <p part="N">HAL API Platform</p>
      </sourceDesc>
    </fileDesc>
  </teiHeader>
  <text>
    <body>
      <listBibl>
        <biblFull>
          <titleStmt>
            <title xml:lang="en">Set-up and deployment of a high-interaction honeypot: experiment and lessons learned</title>
            <author role="aut">
              <persName>
                <forename type="first">Vincent</forename>
                <surname>Nicomette</surname>
              </persName>
              <email type="md5">856b9f10bee31e8f2d94eaf7778fdea7</email>
              <email type="domain">laas.fr</email>
              <idno type="idhal" notation="string">vincent-nicomette</idno>
              <idno type="idhal" notation="numeric">9967</idno>
              <idno type="halauthorid" notation="string">8756-9967</idno>
              <idno type="IDREF">https://www.idref.fr/078717639</idno>
              <idno type="ORCID">https://orcid.org/0000-0001-9482-004X</idno>
              <orgName ref="#struct-389097"/>
              <affiliation ref="#struct-389097"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Mohamed</forename>
                <surname>Kaâniche</surname>
              </persName>
              <email type="md5">1ee68888caed857a3dcbc2e53f464bff</email>
              <email type="domain">laas.fr</email>
              <idno type="idhal" notation="string">mohamed-kaaniche</idno>
              <idno type="idhal" notation="numeric">13942</idno>
              <idno type="halauthorid" notation="string">23325-13942</idno>
              <idno type="ORCID">https://orcid.org/0000-0002-2647-5472</idno>
              <idno type="IDREF">https://www.idref.fr/079087221</idno>
              <orgName ref="#struct-389097"/>
              <affiliation ref="#struct-389097"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Eric</forename>
                <surname>Alata</surname>
              </persName>
              <email type="md5">ff6809813cc09234bdc6fc38873ce9b8</email>
              <email type="domain">laas.fr</email>
              <idno type="idhal" notation="string">eric-alata</idno>
              <idno type="idhal" notation="numeric">171876</idno>
              <idno type="halauthorid" notation="string">32730-171876</idno>
              <idno type="IDREF">https://www.idref.fr/124302505</idno>
              <idno type="ORCID">https://orcid.org/0000-0002-5179-3253</idno>
              <affiliation ref="#struct-389097"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Matthieu</forename>
                <surname>Herrb</surname>
              </persName>
              <email type="md5">1f08739208bac6a8fcbad42d93e7e90b</email>
              <email type="domain">laas.fr</email>
              <idno type="idhal" notation="string">matthieu-herrb</idno>
              <idno type="idhal" notation="numeric">1382</idno>
              <idno type="halauthorid" notation="string">4208-1382</idno>
              <idno type="ORCID">https://orcid.org/0000-0003-3423-7295</idno>
              <idno type="IDREF">https://www.idref.fr/058499741</idno>
              <orgName ref="#struct-399701"/>
              <affiliation ref="#struct-459"/>
            </author>
            <editor role="depositor">
              <persName>
                <forename>Mohamed</forename>
                <surname>Kaaniche</surname>
              </persName>
              <email type="md5">1ee68888caed857a3dcbc2e53f464bff</email>
              <email type="domain">laas.fr</email>
            </editor>
          </titleStmt>
          <editionStmt>
            <edition n="v1" type="current">
              <date type="whenSubmitted">2012-12-07 14:21:56</date>
              <date type="whenModified">2025-10-22 18:04:08</date>
              <date type="whenReleased">2012-12-07 16:14:10</date>
              <date type="whenProduced">2011-05-02</date>
              <date type="whenEndEmbargoed">2012-12-07</date>
              <ref type="file" target="https://hal.science/hal-00762596v1/document">
                <date notBefore="2012-12-07"/>
              </ref>
              <ref type="file" subtype="author" n="1" target="https://hal.science/hal-00762596v1/file/final_auteurs.pdf" id="file-762596-1127036">
                <date notBefore="2012-12-07"/>
              </ref>
              <ref type="externalLink" target="http://hal.inria.fr/docs/00/76/25/96/PDF/final_auteurs.pdf"/>
            </edition>
            <respStmt>
              <resp>contributor</resp>
              <name key="117708">
                <persName>
                  <forename>Mohamed</forename>
                  <surname>Kaaniche</surname>
                </persName>
                <email type="md5">1ee68888caed857a3dcbc2e53f464bff</email>
                <email type="domain">laas.fr</email>
              </name>
            </respStmt>
          </editionStmt>
          <publicationStmt>
            <distributor>CCSD</distributor>
            <idno type="halId">hal-00762596</idno>
            <idno type="halUri">https://hal.science/hal-00762596</idno>
            <idno type="halBibtex">nicomette:hal-00762596</idno>
            <idno type="halRefHtml">&lt;i&gt;Journal in Computer Virology&lt;/i&gt;, 2011, 7 (2), pp.143-157. &lt;a target="_blank" href="https://dx.doi.org/10.1007/s11416-010-0144-2"&gt;&amp;#x27E8;10.1007/s11416-010-0144-2&amp;#x27E9;&lt;/a&gt;</idno>
            <idno type="halRef">Journal in Computer Virology, 2011, 7 (2), pp.143-157. &amp;#x27E8;10.1007/s11416-010-0144-2&amp;#x27E9;</idno>
            <availability status="restricted">
              <licence target="https://about.hal.science/hal-authorisation-v1/">HAL Authorization<ref corresp="#file-762596-1127036"/></licence>
            </availability>
          </publicationStmt>
          <seriesStmt>
            <idno type="stamp" n="UNIV-TLSE2">Université Toulouse 2</idno>
            <idno type="stamp" n="UNIV-TLSE3">Université de Toulouse</idno>
            <idno type="stamp" n="CNRS">CNRS - Centre national de la recherche scientifique</idno>
            <idno type="stamp" n="INSA-TOULOUSE">Institut National des Sciences Appliquées de Toulouse</idno>
            <idno type="stamp" n="LAAS">Laboratoire d'analyse et d'architecture des systèmes</idno>
            <idno type="stamp" n="LAAS-TSF" corresp="LAAS-RISC">Équipe Tolérance aux fautes et Sûreté de Fonctionnement informatique</idno>
            <idno type="stamp" n="UT1-CAPITOLE">Université Toulouse 1 Capitole</idno>
            <idno type="stamp" n="LAAS-IDEA" corresp="LAAS">Service Informatique : Développement, Exploitation et Assistance</idno>
            <idno type="stamp" n="LAAS-INFORMATIQUE-CRITIQUE" corresp="LAAS">LAAS-Informatique Critique</idno>
            <idno type="stamp" n="INSA-GROUPE">Groupe INSA</idno>
            <idno type="stamp" n="INSA-TOULOUSE-GEI" corresp="INSA-TOULOUSE">Génie Electrique et Informatique - INSA Toulouse</idno>
            <idno type="stamp" n="LAAS-RISC" corresp="LAAS">Réseaux, Informatique, Systèmes de Confiance</idno>
            <idno type="stamp" n="TOULOUSE-INP">Toulouse - INP</idno>
            <idno type="stamp" n="UNIV-UT3">Université Toulouse 3</idno>
            <idno type="stamp" n="UT3-INP">Université de Toulouse / Toulouse INP</idno>
            <idno type="stamp" n="UT3-TOULOUSEINP">Université de Toulouse / Toulouse INP</idno>
            <idno type="stamp" n="TEST7-HALCNRS">test 7 du portail hal cnrs</idno>
            <idno type="stamp" n="LAAS-TRUST" corresp="LAAS-RISC">Trustworthy systems: foundations and practices</idno>
          </seriesStmt>
          <notesStmt>
            <note type="audience" n="2">International</note>
            <note type="popular" n="0">No</note>
            <note type="peer" n="1">Yes</note>
          </notesStmt>
          <sourceDesc>
            <biblStruct>
              <analytic>
                <title xml:lang="en">Set-up and deployment of a high-interaction honeypot: experiment and lessons learned</title>
                <author role="aut">
                  <persName>
                    <forename type="first">Vincent</forename>
                    <surname>Nicomette</surname>
                  </persName>
                  <email type="md5">856b9f10bee31e8f2d94eaf7778fdea7</email>
                  <email type="domain">laas.fr</email>
                  <idno type="idhal" notation="string">vincent-nicomette</idno>
                  <idno type="idhal" notation="numeric">9967</idno>
                  <idno type="halauthorid" notation="string">8756-9967</idno>
                  <idno type="IDREF">https://www.idref.fr/078717639</idno>
                  <idno type="ORCID">https://orcid.org/0000-0001-9482-004X</idno>
                  <orgName ref="#struct-389097"/>
                  <affiliation ref="#struct-389097"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Mohamed</forename>
                    <surname>Kaâniche</surname>
                  </persName>
                  <email type="md5">1ee68888caed857a3dcbc2e53f464bff</email>
                  <email type="domain">laas.fr</email>
                  <idno type="idhal" notation="string">mohamed-kaaniche</idno>
                  <idno type="idhal" notation="numeric">13942</idno>
                  <idno type="halauthorid" notation="string">23325-13942</idno>
                  <idno type="ORCID">https://orcid.org/0000-0002-2647-5472</idno>
                  <idno type="IDREF">https://www.idref.fr/079087221</idno>
                  <orgName ref="#struct-389097"/>
                  <affiliation ref="#struct-389097"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Eric</forename>
                    <surname>Alata</surname>
                  </persName>
                  <email type="md5">ff6809813cc09234bdc6fc38873ce9b8</email>
                  <email type="domain">laas.fr</email>
                  <idno type="idhal" notation="string">eric-alata</idno>
                  <idno type="idhal" notation="numeric">171876</idno>
                  <idno type="halauthorid" notation="string">32730-171876</idno>
                  <idno type="IDREF">https://www.idref.fr/124302505</idno>
                  <idno type="ORCID">https://orcid.org/0000-0002-5179-3253</idno>
                  <affiliation ref="#struct-389097"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Matthieu</forename>
                    <surname>Herrb</surname>
                  </persName>
                  <email type="md5">1f08739208bac6a8fcbad42d93e7e90b</email>
                  <email type="domain">laas.fr</email>
                  <idno type="idhal" notation="string">matthieu-herrb</idno>
                  <idno type="idhal" notation="numeric">1382</idno>
                  <idno type="halauthorid" notation="string">4208-1382</idno>
                  <idno type="ORCID">https://orcid.org/0000-0003-3423-7295</idno>
                  <idno type="IDREF">https://www.idref.fr/058499741</idno>
                  <orgName ref="#struct-399701"/>
                  <affiliation ref="#struct-459"/>
                </author>
              </analytic>
              <monogr>
                <idno type="localRef">Rapport LAAS n°09062</idno>
                <idno type="halJournalId" status="VALID">15009</idno>
                <idno type="issn">1772-9890</idno>
                <idno type="eissn">1772-9904</idno>
                <title level="j">Journal in Computer Virology</title>
                <imprint>
                  <publisher>Springer Verlag</publisher>
                  <biblScope unit="volume">7</biblScope>
                  <biblScope unit="issue">2</biblScope>
                  <biblScope unit="pp">143-157</biblScope>
                  <date type="datePub">2011-05-02</date>
                </imprint>
              </monogr>
              <idno type="doi">10.1007/s11416-010-0144-2</idno>
            </biblStruct>
          </sourceDesc>
          <profileDesc>
            <langUsage>
              <language ident="en">English</language>
            </langUsage>
            <textClass>
              <keywords scheme="author">
                <term xml:lang="en">Security threats</term>
                <term xml:lang="en">experimental analysis</term>
                <term xml:lang="en">honeypot</term>
                <term xml:lang="en">dictionary attack</term>
                <term xml:lang="en">intrusion</term>
              </keywords>
              <classCode scheme="halDomain" n="info.info-cr">Computer Science [cs]/Cryptography and Security [cs.CR]</classCode>
              <classCode scheme="halTypology" n="ART">Journal articles</classCode>
              <classCode scheme="halOldTypology" n="ART">Journal articles</classCode>
              <classCode scheme="halTreeTypology" n="ART">Journal articles</classCode>
            </textClass>
            <abstract xml:lang="en">
              <p>This paper presents the lessons learned from an empirical analysis of attackers behaviours based on the deployment on the Internet of a high-interaction honeypot for more than one year. We focus in particular on the attacks performed via the SSH service and the activities performed by the attackers once they gain access to the system and try to progress in their intrusion. The first part of the paper describes: i) the global architecture of the honeypot and the mechanisms used to capture the implementation details so that we can observe attackers behaviours and ii) the details of the experiment itself (duration, data captured, overview of the attackers activity). The second part presents the results of the observation of the attackers. It includes: i) the description of the global attack process, constituted of two main steps, dictionary attacks and intrusions and ii) the detailed analysis of these two main steps.</p>
            </abstract>
            <particDesc>
              <org type="consortium">Projet CADHO ACI Securité et Informatique</org>
            </particDesc>
          </profileDesc>
        </biblFull>
      </listBibl>
    </body>
    <back>
      <listOrg type="structures">
        <org type="researchteam" xml:id="struct-389097" status="OLD">
          <orgName>Équipe Tolérance aux fautes et Sûreté de Fonctionnement informatique</orgName>
          <orgName type="acronym">LAAS-TSF</orgName>
          <date type="end">2024-08-31</date>
          <desc>
            <address>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.laas.fr/public/fr/tsf</ref>
          </desc>
          <listRelation>
            <relation active="#struct-459" type="direct"/>
            <relation active="#struct-81148" type="indirect"/>
            <relation name="443875" active="#struct-443875" type="indirect"/>
            <relation active="#struct-116255" type="indirect"/>
            <relation active="#struct-301232" type="indirect"/>
            <relation active="#struct-443875" type="indirect"/>
            <relation active="#struct-116256" type="indirect"/>
            <relation active="#struct-217752" type="indirect"/>
            <relation name="UPR8001" active="#struct-441569" type="indirect"/>
            <relation active="#struct-448187" type="indirect"/>
          </listRelation>
        </org>
        <org type="laboratory" xml:id="struct-459" status="OLD">
          <idno type="IdRef">199278792</idno>
          <idno type="ISNI">0000 0001 2188 216X </idno>
          <idno type="RNSR">199517454Y</idno>
          <idno type="ROR">https://ror.org/03vcm6439</idno>
          <orgName>Laboratoire d'analyse et d'architecture des systèmes</orgName>
          <orgName type="acronym">LAAS</orgName>
          <date type="start">1968-01-01</date>
          <date type="end">2025-01-01</date>
          <desc>
            <address>
              <addrLine>7 Av du colonel Roche 31077 TOULOUSE CEDEX 4</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.laas.fr</ref>
          </desc>
          <listRelation>
            <relation active="#struct-81148" type="direct"/>
            <relation name="443875" active="#struct-443875" type="indirect"/>
            <relation active="#struct-116255" type="direct"/>
            <relation active="#struct-301232" type="indirect"/>
            <relation active="#struct-443875" type="indirect"/>
            <relation active="#struct-116256" type="direct"/>
            <relation active="#struct-217752" type="direct"/>
            <relation name="UPR8001" active="#struct-441569" type="direct"/>
            <relation active="#struct-448187" type="direct"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-81148" status="VALID">
          <idno type="IdRef">026404354</idno>
          <idno type="ISNI">0000000121902837</idno>
          <idno type="ROR">https://ror.org/0443n9e75</idno>
          <orgName>Université Toulouse Capitole</orgName>
          <orgName type="acronym">UT Capitole</orgName>
          <date type="start">1970-01-01</date>
          <desc>
            <address>
              <addrLine>2 rue du Doyen-Gabriel-Marty - 31042 Toulouse Cedex 9</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.ut-capitole.fr/</ref>
          </desc>
          <listRelation>
            <relation name="443875" active="#struct-443875" type="direct"/>
          </listRelation>
        </org>
        <org type="regroupinstitution" xml:id="struct-443875" status="VALID">
          <idno type="ROR">https://ror.org/017tgbk05</idno>
          <orgName>Communauté d'universités et établissements de Toulouse</orgName>
          <orgName type="acronym">Comue de Toulouse</orgName>
          <desc>
            <address>
              <addrLine>41 Allée Jules Guesde, 31000 Toulouse</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.univ-toulouse.fr/</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-116255" status="VALID">
          <idno type="IdRef">026388766</idno>
          <idno type="ISNI">0000 0001 2286 8343</idno>
          <idno type="ROR">https://ror.org/01h8pf755</idno>
          <idno type="Wikidata">Q858979</idno>
          <orgName>Institut National des Sciences Appliquées - Toulouse</orgName>
          <orgName type="acronym">INSA Toulouse</orgName>
          <date type="start">1963-10-21</date>
          <desc>
            <address>
              <addrLine>135, avenue de Rangueil - 31077 Toulouse cedex 4</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.insa-toulouse.fr</ref>
          </desc>
          <listRelation>
            <relation active="#struct-301232" type="direct"/>
            <relation active="#struct-443875" type="direct"/>
          </listRelation>
        </org>
        <org type="regroupinstitution" xml:id="struct-301232" status="VALID">
          <idno type="IdRef">162105150</idno>
          <orgName>Institut National des Sciences Appliquées</orgName>
          <orgName type="acronym">INSA</orgName>
          <desc>
            <address>
              <country key="FR"/>
            </address>
          </desc>
        </org>
        <org type="institution" xml:id="struct-116256" status="VALID">
          <idno type="IdRef">026403994</idno>
          <idno type="ROR">https://ror.org/04ezk3x31</idno>
          <orgName>Université Toulouse - Jean Jaurès</orgName>
          <orgName type="acronym">UT2J</orgName>
          <date type="start">1971-01-01</date>
          <desc>
            <address>
              <addrLine>5 allées Antonio Machado - 31058 Toulouse Cedex 9</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.univ-tlse2.fr</ref>
          </desc>
          <listRelation>
            <relation active="#struct-443875" type="direct"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-217752" status="OLD">
          <idno type="IdRef">026404672</idno>
          <idno type="ISNI">0000000121617331</idno>
          <idno type="ROR">https://ror.org/02v6kpv12</idno>
          <idno type="Wikidata">Q1273188</idno>
          <orgName>Université Toulouse III - Paul Sabatier</orgName>
          <orgName type="acronym">UT3</orgName>
          <date type="end">2025-01-01</date>
          <desc>
            <address>
              <addrLine>118 route de Narbonne - 31062 Toulouse</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.univ-tlse3.fr/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-443875" type="direct"/>
          </listRelation>
        </org>
        <org type="regroupinstitution" xml:id="struct-441569" status="VALID">
          <idno type="IdRef">02636817X</idno>
          <idno type="ISNI">0000000122597504</idno>
          <idno type="ROR">https://ror.org/02feahw73</idno>
          <orgName>Centre National de la Recherche Scientifique</orgName>
          <orgName type="acronym">CNRS</orgName>
          <date type="start">1939-10-19</date>
          <desc>
            <address>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.cnrs.fr/</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-448187" status="VALID">
          <idno type="IdRef">026388820</idno>
          <idno type="ISNI">0000000121766169</idno>
          <idno type="ROR">https://ror.org/033p9g875</idno>
          <orgName>Institut National Polytechnique (Toulouse)</orgName>
          <orgName type="acronym">Toulouse INP</orgName>
          <desc>
            <address>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.inp-toulouse.fr/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-443875" type="direct"/>
          </listRelation>
        </org>
      </listOrg>
    </back>
  </text>
</TEI>