Vulnerability Assessment using Honeypots
-
M. Dornseif
ABSTRACT
Honeypots are electronic bait, i.e. network resources (computers, routers, switches, etc.) deployed to be probed, attacked and compromised. Honeypots run special software which permanently collects data about the system and greatly aids in post-incident computer and network forensics. Several honeypots can be assembled into networks of honeypots called honeynets. Because of the wealth of data collected through them, honeynets are considered a useful tool to learn more about attack patterns and attacker behavior in real networks. This paper explains the motivation for using the honeynet methodology and describes experiences with a honeynet at RWTH Aachen University. In analyzing the data collected through our experiment, we discuss the value of honeynets for computer vulnerability assessment. The paper also gives an overview over ethical and legal aspects of honeypots and a look on possible directions for further research.
© Copyright by K.G. Saur Verlag 2004
Articles in the same Issue
- Reactive Security – Intrusion Detection, Honeypots, and Vulnerability Assessment
- Honeynet Operation within the German Research Network – A Case Study
- Vulnerability Assessment using Honeypots
- A Network of IDS Sensors for Attack Statistics
- Foundations for Intrusion Prevention
- Using Alert Verification to Identify Successful Intrusion Attempts
- Intrusion Detection in Unlabeled Data with Quarter-sphere Support Vector Machines
- Trust-Based Monitoring of Component-Structured Software
- Linux Diskless Clients – Festplattenlose Systeme für den Kursraumbetrieb
- Alois Potton hat das Wort
Articles in the same Issue
- Reactive Security – Intrusion Detection, Honeypots, and Vulnerability Assessment
- Honeynet Operation within the German Research Network – A Case Study
- Vulnerability Assessment using Honeypots
- A Network of IDS Sensors for Attack Statistics
- Foundations for Intrusion Prevention
- Using Alert Verification to Identify Successful Intrusion Attempts
- Intrusion Detection in Unlabeled Data with Quarter-sphere Support Vector Machines
- Trust-Based Monitoring of Component-Structured Software
- Linux Diskless Clients – Festplattenlose Systeme für den Kursraumbetrieb
- Alois Potton hat das Wort
