Automatic analysis of attack data from distributed honeypot network

Jakub Safarik; MIroslav Voznak; Filip Rezac; Pavol Partila; Karel Tomala

doi:10.1117/12.2015514

28 May 2013 Automatic analysis of attack data from distributed honeypot network

Jakub Safarik, MIroslav Voznak, Filip Rezac, Pavol Partila, Karel Tomala

Proceedings Volume 8755, Mobile Multimedia/Image Processing, Security, and Applications 2013; 875512 (2013) https://doi.org/10.1117/12.2015514
Event: SPIE Defense, Security, and Sensing, 2013, Baltimore, Maryland, United States

Abstract

There are many ways of getting real data about malicious activity in a network. One of them relies on masquerading monitoring servers as a production one. These servers are called honeypots and data about attacks on them brings us valuable information about actual attacks and techniques used by hackers. The article describes distributed topology of honeypots, which was developed with a strong orientation on monitoring of IP telephony traffic. IP telephony servers can be easily exposed to various types of attacks, and without protection, this situation can lead to loss of money and other unpleasant consequences. Using a distributed topology with honeypots placed in different geological locations and networks provides more valuable and independent results. With automatic system of gathering information from all honeypots, it is possible to work with all information on one centralized point. Communication between honeypots and centralized data store use secure SSH tunnels and server communicates only with authorized honeypots. The centralized server also automatically analyses data from each honeypot. Results of this analysis and also other statistical data about malicious activity are simply accessible through a built-in web server. All statistical and analysis reports serve as information basis for an algorithm which classifies different types of used VoIP attacks. The web interface then brings a tool for quick comparison and evaluation of actual attacks in all monitored networks. The article describes both, the honeypots nodes in distributed architecture, which monitor suspicious activity, and also methods and algorithms used on the server side for analysis of gathered data.

Citation Download Citation

Jakub Safarik, MIroslav Voznak, Filip Rezac, Pavol Partila, and Karel Tomala "Automatic analysis of attack data from distributed honeypot network", Proc. SPIE 8755, Mobile Multimedia/Image Processing, Security, and Applications 2013, 875512 (28 May 2013); https://doi.org/10.1117/12.2015514

ACCESS THE FULL ARTICLE

INSTITUTIONAL
Select your institution to access the SPIE Digital Library.

SELECT YOUR INSTITUTION

PERSONAL
Sign in with your SPIE account to access your personal subscriptions or to use specific features such as save to my library, sign up for alerts, save searches, etc.

PERSONAL SIGN IN

No SPIE Account? Create one

PURCHASE THIS CONTENT

SUBSCRIBE TO DIGITAL LIBRARY

50 downloads per 1-year subscription

Members: $195

Non-members: $335 ADD TO CART

25 downloads per 1 - year subscription

Members: $145

Non-members: $250 ADD TO CART

PURCHASE SINGLE ARTICLE

Includes PDF, HTML & Video, when available