Comparative survey of local honeypot sensors to assist network forensics

Chen, P T; Laih, C S; Pouget, Fabien; Dacier, Marc
SADFE 2005, 1rst International Workshop on Systematic Approaches to Digital Forensic Engineering, November 7-9, 2005, Taipei, Taiwan

This paper intends to illustrate the usefulness of deploying multiple simple honeypot
sensors in a large variety of locations. Indeed, a permanent identification of anomalies that occur on a single sensor allows pinpointing abnormal local activities. These can be the manifest of misconfiguration issues or highlight attacks particular to some given
environments. Both cases are important for administrators in charge of the networks hosting the sensors. We propose in this paper a comparison of simple parameters that reveal to be an easy way to determine these abnormal and particular activities. On the basis of two identical honeypot sensors that we have deployed for more than 6 months in France and in Taiwan, we detail the analysis of some anomalies that have been found against one unique sensor only. This is a preliminary but useful stage for network forensics and we intend in a near future to deploy the method over a large number of sensors. This is an on-going work and we hope that the illustrations we provide all along the paper will be a good incentive for partners to join this open project.

Sécurité numérique
Eurecom Ref:
© 2005 IEEE. Personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution to servers or lists, or to reuse any copyrighted component of this work in other works must be obtained from the IEEE.
See also: