Honeypots That Bite Back: A Fuzzy Technique for Identifying and Inhibiting Fingerprinting Attacks on Low Interaction Honeypots

Naik, Nitin, Jenkins, Paul, Cooke, Roger and Yang, Longzhi (2018) Honeypots That Bite Back: A Fuzzy Technique for Identifying and Inhibiting Fingerprinting Attacks on Low Interaction Honeypots. In: 2018 IEEE International Conference on Fuzzy Systems (FUZZ-IEEE). IEEE. ISBN 978-1-5090-6021-4

[img]
Preview
Text
Fingerprinting_Honeypot_NitinNaik.pdf - Accepted Version

Download (506kB) | Preview
Official URL: http://doi.org/10.1109/FUZZ-IEEE.2018.8491456

Abstract

The development of a robust strategy for network security is reliant upon a combination of in-house expertise and for completeness attack vectors used by attackers. A honeypot is one of the most popular mechanisms used to gather information about attacks and attackers. However, low-interaction honeypots only emulate an operating system and services, and are more prone to a fingerprinting attack, resulting in severe consequences such as revealing the identity of the honeypot and thus ending the usefulness of the honeypot forever, or worse, enabling it to be converted into a bot used to attack others. A number of tools and techniques are available both to fingerprint low-interaction honeypots and to defend against such fingerprinting; however, there is an absence of fingerprinting techniques to identify the characteristics and behaviours that indicate fingerprinting is occurring. Therefore, this paper proposes a fuzzy technique to correlate the attack actions and predict the probability that an attack is a fingerprinting attack on the honeypot. Initially, an experimental assessment of the fingerprinting attack on the lowinteraction honeypot is performed, and a fingerprinting detection mechanism is proposed that includes the underlying principles of popular fingerprinting attack tools. This implementation is based on a popular and commercially available low-interaction honeypot for Windows - KFSensor. However, the proposed fuzzy technique is a general technique and can be used with any low-interaction honeypot to aid in the identification of the fingerprinting attack whilst it is occurring; thus protecting the honeypot from the fingerprinting attack and extending its life.

Item Type: Book Section
Subjects: G400 Computer Science
Department: Faculties > Engineering and Environment > Computer and Information Sciences
Depositing User: Becky Skoyles
Date Deposited: 17 Sep 2018 14:20
Last Modified: 11 Oct 2019 14:17
URI: http://nrl.northumbria.ac.uk/id/eprint/35741

Actions (login required)

View Item View Item

Downloads

Downloads per month over past year

View more statistics