Introduction%20to%20Honeypot,%20Botnet,%20and%20Security%20Measurement - PowerPoint PPT Presentation
Title:
Introduction%20to%20Honeypot,%20Botnet,%20and%20Security%20Measurement
Description:
Introduction to Honeypot, Botnet, and Security Measurement Cliff C. Zou 02/07/06 – PowerPoint PPT presentation
Number of Views:234
Avg rating:3.0/5.0
Title: Introduction%20to%20Honeypot,%20Botnet,%20and%20Security%20Measurement
1
Introduction to Honeypot, Botnet, and Security
Measurement
- Cliff C. Zou
- 02/07/06
2
What Is a Honeypot?
- Abstract definition
- A honeypot is an information system resource
whose value lies in unauthorized or illicit use
of that resource. (Lance Spitzner) - Concrete definition
- A honeypot is a faked vulnerable system used
for the purpose of being attacked, probed,
exploited and compromised.
3
Example of a Simple Honeypot
- Install vulnerable OS and software on a machine
- Install monitor or IDS software
- Connect to the Internet (with global IP)
- Wait monitor being scanned, attacked,
compromised - Finish analysis, clean the machine
4
Benefit of Deploying Honeypots
- Risk mitigation
- A deployed honeypot may lure an attacker away
from the real production systems (easy target). - IDS-like functionality
- Since no legitimate traffic should take place to
or from the honeypot, any traffic appearing is
evil and can initiate further actions. - Attack analysis
- Find out reasons, and strategies why and how you
are attacked.
5
Benefit of Deploying Honeypots
- Evidence
- Once the attacker is identified all data captured
may be used in a legal procedure. - Increased knowledge
- By knowing how you are attacked you are able to
enlarge your ability to respond in an appropriate
way and to prevent future attacks. - Research
- Operating and monitoring a honeypot can reveal
most up-to-date techniques/exploits and tools
used as well as internal communications of the
hackers or infection or spreading techniques of
worms or viruses.
6
Honeypot Classification
- High-interaction honeypots
- A full and working OS is provided for being
attacked - VMware virtual environment
- Several VMware virtual hosts in one physical
machine - Low-interaction honeypots
- Only emulate specific network services
- No real interaction or OS
- Honeyd
- Honeynet/honeyfarm
- A network of honeypots
7
Low-Interaction Honeypots
- Pros
- Easy to install (simple program)
- No risk (no vulnerable software to be attacked)
- One machine supports hundreds of honeypots
- Cons
- No real interaction to be captured
- Limited logging/monitor function
- Easily detectable by attackers
8
High-Interaction Honeypots
- Pros
- Real OS, capture all attack traffic/actions
- Can discover unknown attacks/vulnerabilites
- Cons
- Time-consuming to build/maintain
- Time-consuming to analysis attack
- Risk of being used as stepping stone
- High computer resource requirement
9
Honeynet
- A network of honeypots
- High-interaction honeynet
- A distributed network composing many honeypots
- Collapsar A VM-Based Architecture for Network
Attack Detention Center, Usenix04 - Low-interaction honeynet
- Emulate a virtual network in one physical machine
- Example honeyd
- Mixed honeynet
- Scalability, Fidelity and Containment in the
Potemkin Virtual Honeyfarm, presented next week - Reference http//www.ccc.de/congress/2004/fahrpla
n/files/135-honeypot-forensics-slides.ppt
10
What Is a Botnet?
- A network of compromised computers controlled by
their attacker - Users on zombie machines do not know
- The main source for many attacks now
- Distributed Denial-of-Service (DDoS)
- Extortion
- Email spam, phishing
- Ad-fraud
- User information document, keylogger,
11
How to Build a Botnet?
- Infect machines via
- Internet worms, viruses
- Email virus
- Backdoor left by previous malware
- Trojan programs
- Bots phone back to receive command
12
Botnet Architecture
- Bot controller
- Usually using IRC server (Internet relay chat)
- Dozen of controllers for robustness
13
Botnet Monitoring
- Hijack one of the bot controller
- DNS provider redirects domain name to the monitor
- Still cannot cut off a botnet (dozen of
controller) - Can obtain most/all bots IP addresses
- Let honeypots join in a botnet
- Can monitor all communications
- No complete picture of a botnet
14
Security Measurement
- Monitor network traffic to understand/track
Internet attack activities - Monitor incoming traffic to unused IP space
- TCP connection requests
- UDP packets
Internet
Unused IP space
Local network
15
Refining Monitoring
- TCP/SYN not enough (IP, port only)
- Distinguish different attacks
- Low-interaction honeypots (honeyd)
- Obtain the first attack payload by replying
SYN/ACK - Internet Motion Sensor presented next week
- High-interaction honeypots
- TCP Reset packets
- Backscatter from spoofed DoS attack victims
- Inferring Internet Denial-of-Service Activity,
presented later
16
Remote fingerprinting
- Actively probe remote hosts to identify remote
hosts OS, physical devices, etc - OSes service responses are different
- Hardware responses are different
- Purposes
- Understand Internet computers
- Remove DHCP issue in monitored data
17
Data Sharing Traffic Anonymization
- Sharing monitored network traffic is important
- Collaborative attack detection
- Academic research
- Privacy and security exposure in data sharing
- Packet header IP address, service port exposure
- Packet content more serious
- Data anonymization
- Change packet header preserve IP prefix, and
- Change packet content
Recommended
CrystalGraphics Presentations
