My paper of choice was "A Honeypot System for Efficient Capture and Analysis of Network Attack Traffic" by Abhay Nath Singh and R.C.Joshi. I was particularly interested in this topic, because we are planning to put our server out to be accessible outside of our CS VPN, and our app will be more exposed to the real world. I've never used honeypots and this might be something that I will consider install on our server as a defense mechanism.
Honeypots are servers that intended to be hacked, in order to analyze emerging attacker tools and techniques and keep up with new and unknown treats. The paper talks about the low and high interaction systems, that differs in deployment and capabilities, but they share the common goal of faking a vulnerable system and actively or passively deceive various aspects of a network and emulate non-existing services.
The authors focused on improving currently existing use cases of honeypot analysis methods, as they argued that log analysis and storages is cumbersome and expensive. They managed to shrink the size of the generated log files, but I was more focused on the process, how honeypots work. I will continue to research in this area, as it can be a valuable experience.
Thanks for reading
--
Balazs Makany
No comments:
Post a Comment