An improved honeypot model for attack detection and analysis - Archive ouverte HAL
Communication Dans Un Congrès Année : 2023

An improved honeypot model for attack detection and analysis

Résumé

This paper presents a new model and design for honeypots, and the results obtained the implementation and exposure on the internet of an high interaction honeypot. We show that our model can allow higher interaction with attackers while preserving integrity and attractiveness. In our work, we use threat analysis based on the MITRE ATT&CK taxonomy to describe the design and supervision constraints of our honeypot with it's situation in our implemented architecture. We exposed our infrastructure during seventeen days and collected information about several actors and attack methods, from which we extracted previously undocumented Indicators of Compromise.
Fichier principal
Vignette du fichier
3600160.3604993.pdf (675.3 Ko) Télécharger le fichier
Origine Fichiers éditeurs autorisés sur une archive ouverte

Dates et versions

hal-04400399 , version 1 (17-01-2024)

Identifiants

Citer

Marwan Abbas-Escribano, Hervé Debar. An improved honeypot model for attack detection and analysis. The 18th International Conference on Availability, Reliability and Security (ARES), Aug 2023, Benevento, France. pp.1-10, ⟨10.1145/3600160.3604993⟩. ⟨hal-04400399⟩
51 Consultations
300 Téléchargements

Altmetric

Partager

More