Honeypots: Practical means to validate malicious fault assumptions

Proceedings - IEEE Pacific Rim International Symposium on Dependable Computing

Volumn , Issue , 2004, Pages 383-388

  Dacier, Marc ^a   Pouget, Fabien ^a   Debar, Hervé ^b  

^a EURECOM   (France)

^b ORANGE LABS   (France)

Author keywords

[No Author keywords available]

Indexed keywords

DEPENDABILITY; HONEYPOTS; INTRUSION TOLERANT SYSTEMS; NIMDA;

COMPUTER NETWORKS; COMPUTER WORMS; DATA PROCESSING; PROBLEM SOLVING; SECURITY OF DATA; STATISTICAL METHODS;

FAULT TOLERANT COMPUTER SYSTEMS;

EID: 2642562805     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/PRDC.2004.1276594     Document Type: Conference Paper

References (34)

1. H. AbdelallahElhadj, H. M. Khelalfa and H. M. Kortebi, "An experimental sniffer detector: SnifferWall", SEcurité des Communications sur Internet Workshop (SECI'02), Tunisia, Sept. 2002.
2. O. Arkin, "ICMP Usage in Scanning - The complete Know-How", The Sys-Security Group. Version 3.0. June 2001. (www.sys-security.com)
3. S. Bellovin, "There Be Dragons", Proc. of the Third Usenix Security Symposium, Baltimore MD. Sept. 1992.
4. S. M. Bellovin, "Packets Found on an Internet", Computer Communications Review 23:3, pp. 26-31, July 1993.
5. Cooperative Association for Internet Data Analysis, home page: www.caida.org
6. The sleuth kit V1.62 (previously known as TASK), Brian Carrier, 2003, www.sleuthkit.org/
7. B. Cheswick, "An evening with Berferd in which a cracker is lured, endured and studied", Proc Winter USENIX Conference, San Francisco, Jan 20, 1992.
8. F. Cohen, D. Lambert, C. Preston, N. Berry, C. Stewart and E. Thomas, "A Framework for Deception", Tech. Report, July 2001, http://all.net/journal/deception/Framework/Framework.html
9. P. Cracknell, "The wireless honeypot project: A brief look at haw wireless networks are used and misused in the City of London", RSA Security UK Limited (RSA SUL), CISSP, Tech. Report, http:/www.rsasecurity.com/worldwide/ downloads/honeypotreport2003.pdf
10. H. Debar and D. Lefranc, "Observations on the Internet traffic reaching broadband-connected users", EICAR Conference, Copenhagen, Mai 2003.
11. The Disco tool home page: http://www.altmode.com/disco
12. J. Evers, "Experts: Most Code Red attacks coming from Asia", IDG News Service, 2001. Available on line: www.computerworld.com/securitytopics/ security/story/0.10801.62730.00.html
13. Coroner toolkit, D. Farmer, W. Venema, home page: http://www.porcupine. org/forensics/tct.html
14. Stéphane Grundschober, "Sniffer Detector Report", Internship Report from IBM Zurich for the Eurecom Institute, June 1998, 50 pages, ref. Eurecom: CE-98/IBM/GRUN - Document number: 1914. Available on line: http://www.eurecom.fr/~nsteam/Papers/grundschober98.ps
15. S. Grundschober, M. Dacier, "Design and Implementation of a Sniffer Detector", Recent Advances on Intrusion Detection Workshop (RAID98), 1998. www.raid-symposium.org/raid98/
16. Irish Honeynet Alliance members. Collected data available on line: www.honeynet.ie/results.htm
17. Honeypot mailing list, FAQ; www.securityfocus.com/popups/forums/ honeypots/faq.shtml
18. "Know Your Enemy: Statistics Analyzing the past ... predicting the future", Honeynet Project, July 2001. Available on line: http://project.honeynet.org/papers/stats
19. Internet Management Workshop 2001, home page: http://www.icir.org/vern/ imw-2001/
20. Internet Management Workshop 2002, home page: http://www.icir.org/vern/ imw-2002/
21. Internet Management Conference 2003, home page: http://www.icir.org/vern/ imc-2003/
22. E. Jacksch, "Tenebris Wireless Honeypot Project: Assessing the threat against wireless access points. 1.0", CISSP, Tenebris Technologies Inc, 2002. www.tenebris.ca/docs/TWHP20021119.pdf
23. D. Moore, G. Voelker et S. Savage. "Inferring Internet Denial-of-Service Activity", 2001 USENDC Sec. Symp.
24. Netgeo Utility, available online at http://netgeo.caida.org/perl/netgeo. cgi
25. A. Neville, "IDS Logs in Forensics Investigations: An Analysis of a Compromised Honeypot", March 2003. Available on line: http://www. securityfocus.com/infocus/1676
26. F. Pouget, M. Dacier, H. Debar. "Honeypot: a comparative survey", Eurecom Report, RR-03-81
27. Honeyd Home page, Niels Provos, http://www.citi.umich.edu/u/provos/ honeyd/
28. C. Stoll, "Stalking the Wiley Hacker", Communications of the ACM, Vol. 31 No 5. May 1988.
29. L. Spitzner, "Honeypots: Tracking Hackers", Addislon-Wesley, ISBN from-321-10895-7, 2002.
30. L. Spitzner, "Honeytokens: The Other Honeypot", 2003. www.securityfocus.eom/infocus/1713
31. Tcpdump home page:http://www.tcpdump.org/
32. VMWARE, User's manual. Version 3.1, home page: http://www.vmware.com
33. WISE, Wireless Information Security Experiment, http://www.incident- response.org/WISE.htm
34. "The museum of broken packet", M. Zalewski, http://lcamtuf.coredump.cx/mobp/