Automatic analysis of attack data from distributed honeypot network

Jakub Safarik; MIroslav Voznak; Filip Rezac; Pavol Partila; Karel  Tomala

doi:10.1117/12.2015514

Abstract

There are many ways of getting real data about malicious activity in a network. One of them relies on masquerading monitoring servers as a production one. These servers are called honeypots and data about attacks on them brings us valuable information about actual attacks and techniques used by hackers. The article describes distributed topology of honeypots, which was developed with a strong orientation on monitoring of IP telephony traffic. IP telephony servers can be easily exposed to various types of attacks, and without protection, this situation can lead to loss of money and other unpleasant consequences. Using a distributed topology with honeypots placed in different geological locations and networks provides more valuable and independent results. With automatic system of gathering information from all honeypots, it is possible to work with all information on one centralized point. Communication between honeypots and centralized data store use secure SSH tunnels and server communicates only with authorized honeypots. The centralized server also automatically analyses data from each honeypot. Results of this analysis and also other statistical data about malicious activity are simply accessible through a built-in web server. All statistical and analysis reports serve as information basis for an algorithm which classifies different types of used VoIP attacks. The web interface then brings a tool for quick comparison and evaluation of actual attacks in all monitored networks. The article describes both, the honeypots nodes in distributed architecture, which monitor suspicious activity, and also methods and algorithms used on the server side for analysis of gathered data.

Citation Download Citation

Jakub Safarik, MIroslav Voznak, Filip Rezac, Pavol Partila, Karel Tomala, "Automatic analysis of attack data from distributed honeypot network", Proc. SPIE 8755, Mobile Multimedia/Image Processing, Security, and Applications 2013, 875512 (28 May 2013); doi: 10.1117/12.2015514; https://doi.org/10.1117/12.2015514

ACCESS THE FULL ARTICLE

PERSONAL SIGN IN
Full access may be available with your subscription

Email or Username Forgot your username?

Password Forgot your password?

Show

Remember Email/Username on this computer

Remember Password

No SPIE account? Create an account
or Institutional Sign In via Shibboleth

PURCHASE THIS CONTENT

SUBSCRIBE TO DIGITAL LIBRARY

50 downloads per 1-year subscription

Members: $195

Non-members: $335 ADD TO CART

25 downloads per 1 - year subscription

Members: $145

Non-members: $250 ADD TO CART

PURCHASE SINGLE ARTICLE

Includes PDF, HTML & Video, when available

Members: $14.40

Non-members: $18.00 ADD TO CART

Show All Keywords

Keywords/Phrases

Search In:

Publication Years