Name
Abstract | ||
|---|---|---|
Honeypots have emerged as an important tool in the field of Intrusion Detection Systems Honeypots are decoy machines whose sole purpose is to be compromised by network attackers, in order to gain information about the attack techniques The biggest challenge in deploying honeypots is their configuration and maintenance compounded with the fact that they either emulate a few services or provide the real services The emulated services, which are usually implemented using scripts, are restricted by the responses given to the attacker This limits the amount of information that can be gathered The scipts are also much easier to be detected by the attacker On the other hand, the drawback of providing real services is the greater risk associated with their use. In this paper, we describe service-mining, a machine learning approach to learn and emulate behavior of real-world services Given large enough traces of the real-service interactions and some basic information about the service, we propose a scheme whereby we can learn the semantics of its various commands and then effectively emulate the service This service may then be deployed on a honeypot to capture attack signatures without posing a threat to the complete network. Our initial experience in trying to emulate the popular FTP service is promising We are able to learn the FTP service and then intelligently and consistently respond to user queries with our emulated FTP service. |
Year | DOI | Venue |
|---|---|---|
2004 | 10.1007/978-3-540-30555-2_55 | ICDCIT |
Keywords | Field | DocType |
attack technique,network attacker,basic information,decoy machine,attack signature,real-world service,complete network,valid service,towards automatic learning,real service,intrusion detection systems honeypots,biggest challenge,intrusion detection system,machine learning | Drawback,Honeypot,File Transfer Protocol,Computer science,Computer security,Computer network,Automatic learning,Intrusion detection system,Semantics,Scripting language,Distributed computing | Conference |
Volume | ISSN | ISBN |
3347 | 0302-9743 | 3-540-24075-6 |
Citations | PageRank | References |
1 | 0.35 | 6 |
Authors | ||
3 | ||
Name | Order | Citations | PageRank |
|---|---|---|---|
| Vishal Chowdhary | 1 | 175 | 7.80 |
| Alok Tongaonkar | 2 | 241 | 14.88 |
| Tzi-cker Chiueh | 3 | 3224 | 366.56 |