| Abstract |
Internet security is an arms race between attackers and the whitehat com¬munity. Honeypots are a valuable asset that helps researchers and security experts obtain knowledge for both known and unknown attacks. Honey-pots are specially designed hosts set up to act as decoys for attackers and automated attacking tools. Since a single honeypot host can only receive a small portion of the unsolicited internet traffic and thus has limited chances to be the victim of a cyber attack, a distributed monitoring infrastructure of cooperative honeypots is needed.
Network of Affined Honeypots (NoAH) aims to develop and deploy a large scale system of honeypots which cooperate in order to identify new and an¬alyze existing attacks. NoAH is composed of a core that is comprised of low and high interaction honeypots, which are responsible for interacting with the attackers and analyze the received traffic. Apart from the core, there are tunneling and funneling mechanisms that collect and direct traffic from participating honeypots to the NoAH core. Moreover, home users and small enterprises can participate in NoAH infastructure through Honey@Home tool. Honey@Home listens to the unused address space of a home or en¬terprise network and forwards received traffic to the NoAH core. In this thesis we present a prototype deployment of the NoAH infastructure along with some experimental results and record our experiences with the NoAH infrastructure. Results suggest that we can build a robust and effective infrastructure with moderate resource requirements.
|
Prototype Deployment of the Network of Affined Honeypots Architecture
