Hybrid honeypots for network security
- 1. HYBRID HONEYPOTS FOR NETWORK SECURITY
- 2. content 1. INTRODUCTION 2. DEFINITION OF HONEYPOT 3. LEVELS OF INTERACTION 4. High level-interaction 5. honeynet 6. Low level-interaction 7. honeyed 8. COMPARISON 9. HYBRID HONEYPOT ARCHITECTURE 10. HYBRID HONEYPOT WORKING 11. Detection 12. Signature quality 13. Signature generation 14. True/false positive ratio 15. conclusion
- 3. INTRODUCTION The purposes of honeypot are to detected and learn from attacks and use that information provides network security. Honeypots are analyzed by their role of application, which is meant it can be used for production and research. DEFINITION OF HONEYPOT: "A honeypot is security resource whose value lies in being probed, attacked, or compromised”. A honeypot is a system that is built and set up in order to be hacked.
- 4. LEVEL OF INTERACTION: Level of interaction determines the amount of functionality a honeypot provides HIGH INTERACTION High learning ,complexity & risk LOW INTERACTION Low learning ,complexity & risk
- 5. HIGH LEVEL INTERACTION To reduce the load of high-interaction honeypots an effort is made in architecture of high-interaction honeypot by preprocessing the traffic using low-interaction honeypots as much as possible. A high-interaction honeypot can be compromised completely, allowing an adversary to gain full access to the system and use it to launch further network attacks. In High Interaction Honeypots nothing is emulated everything is real. High Interaction Honeypots provide a far more detailed picture of how an attack or intrusion progresses or how a particular malware execute in real-time.
- 6. HONEYNET Example of high-interaction honeypot is honeynet. A honeynet is a network of multiple systems. Honeynet can collect in-depth information about attackers, such as their keystrokes when they compromise a system, their chat sessions with fellow black hats, or the tools they use to probe and exploit vulnerable systems. This data can provide incredible insight on the attacker themselves.
- 8. LOW LEVEL INTERACTION This kind of honeypot has a small chance of being compromised. It is production honeypot. Typical use of low-interaction honeypot includes: port scans identification, generation of attack signatures, trend analysis and malware collection.
- 9. HONEYED This is an example of low interaction honeypot . Honeyd is an open source low-interactivity honeypot system that creates virtual hosts that can be configured to run arbitrary services and their personality can be adapted so that they appear to be running certain operating systems. Honeyd enables a single host to claim multiple addresses.
- 11. Comparison Between High-Interaction & Low-Interaction Characteristics Low-Interaction Honeypot High-Interaction Honeypot Degree of Involvement Low High Real Operating System No Yes Risk Low High Information Gathering Connections All CompromisedWished No Yes Knowledge to Run Low High Knowledge to Develop Low Mid-High MaintenanceTime Low Very High
- 12. HYBRID HONEYPOT HYBRID HONEYPOT ARCHITECTURE THIS IS AN EXAMPLE OF COMBINATION OF LOW-INTERACTION HONEYPOT & HIGH- INTERACTION HONEYPOT. In this system, low- interaction honeypot act as lightweight proxy. We want high-interaction honeypot to process all We need to offload them as front end to high-interaction honeypot because it is instrumented machines. Honeyd has the appropriate properties to play the role of the front end and acts as a filtering component. The lightweight proxy responds only to TCP/SYN requests to ports that are open.
- 13. HYBRID HONEYPOT WORKING The attacker sends a TCP/ SYN packet to the low-interaction honeypot. If it is set to listen port, then it sends a SYN/ACK packet & waits to receive the next packet. If the packet is not an ACK then the low- interaction honeypot assumes that it was a port scan and the connection is dropped. If the third packet received is ACK then it is a valid TCP connection and the zero point is reached. Thus the low interaction honeypot connects with the high-interaction honeypot running the requested service. Thenaftertheconnectionestablishmentthelow-interactionhoneypot continuestoworkasaproxy. Aslowandhigh-interactionhoneypotsbelongtothesamelocalnetwork,no additionaldelaywillbeperceivedbytheattacker. This diagramshowshow the Signalissent&received,theprocess Ofmessagetransformation. ACK-ACKnowledgement TCP-TransferControlProtocol
- 14. DETECTION: Wormsoftenusethesamepropagationmethodfromhosttohost;wecanapplythesame contentchecksummingalgorithmtopacketoutofthebackendhoneypotandmatchthemtothe MD5oftheinboundconnection. Probe Size: The number of different attacks (true positives/false negatives) or the number of benign interactions (true negatives/false positives) if available.Establishment of Ground Truth.: Manual analysis: We did a manual analysis to find the actual number of attacks. Reference system Attack injection Attack only Benign only Concept Attack Detection Setup: The setup used to evaluate attack detection. Parameters Real-world deployment Lab deployment, real- world attacks Lab deployment, synthesized attacks
- 15. SIGNATURE QUALITY Signature Generation Setup: The setup used to generate the set of signatures for the signature quality assessment. Real-world deployment Lab deployment, synthesized traffic Lab deployment, replayed traffic traces Lab deployment, replayed but modified traffic traces Analytically assessed Establishment of Ground Truth Parameters : Manual analysis Reference system Attack injection Attack only
- 16. SIGNATURE GENERATION Signature generation is the process of defining all the necessary characteristics of a new thread to be able to detect a new occurrence of the threat, identify existing infected hosts, and immunize against additional infections. This system depicts the interaction between HOST and NETWORK based attack. Here we use Dynamic Tiant
- 17. True/FalsePositiveRatio True Positive Ratio (TPR) is a way showing how good the intrusion detection is at alerting on real attacks. In our setting we use this to better performance. TPR is obtained by the following formula: Where, TP= the number of alerts on malicious traffic, FN= the number of missing alerts on malicious traffic. The total number of intrusion is given by TP+FN. False Positive Ratio (FPR) shows the proportion of instances, which were not an attack but still were alerted on. FPR is result of the following formula: Where, FP=the number of alerts on benign traffic, TN= the number of correct decisions on benign traffic. The total number of no-intrusion is given by FP+TN.
- 18. CONCLUSION Using hybrid honeypot, we achieve a number of goals: First, we need to maintain only a small number of high- interaction honeypots since the portion of the traffic will be routed to them is limited. All port- scan attempts or connection to port that is not open will be stopped by low-interaction honeypots. Second, the high-interaction honeypots will be placed in a monitored network. Thus if a honeypot gets infected, the infection rate will be controllable either through limiting bandwidth or traffic reflection. Honeypots offer a unique perspective to defending networks by learning the habits and techniques of the black hat at an additional cost of minimal network alert reporting and monitoring time.