Lessons learned from the deployment of a high-interaction honeypot

Proceedings - Sixth European Dependable Computing Conference, EDCC 2006

Volumn , Issue , 2006, Pages 39-44

  Alata, E ^a   Nicomette, V ^a   Kaaniche M ^a   Dacier, M ^b   Herrb, M ^a  

^a UNIVERSITÉ DE TOULOUSE   (France)

^b EURECOM   (France)

Author keywords

[No Author keywords available]

Indexed keywords

DATA REDUCTION; INTERFACES (COMPUTER); INTRUSION DETECTION; PROBLEM SOLVING;

HIGH INTERACTION HONEYPOT; LOW-INTERACTION HONEYPOTS;

DISTRIBUTED COMPUTER SYSTEMS;

EID: 34547491379     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/EDCC.2006.17     Document Type: Conference Paper

References (17)

1. M. Bailey, E. Cooke, F. Jahanian, J. Nazario, The Internet motion sensor - a distributed blackhole monitoring system. Network and Distributed Systems Security Symp. (NDSS 2005), San Diego, USA, 2005.
2. CAIDA Project. Home Page of the CAIDA Project, http://www.caida.org.
3. http://www.dshield.org. Home page of the DShield.org Distributed Intrusion Detection System.
4. E. Alata, M. Dacier, Y. Deswarte, M. Kaaniche, K. Kortchinsky, V. Nicomette, V. Hau Pham, and F. Pouget, Collection and analysis of attack data based on honeypots deployed on the Internet. QOP 2005, 1st Workshop on Quality of Protection (co-located with ESORICS and METRICS), Sept. 15, Milan, Italy, 2005.
5. F. Pouget, M. Dacier, V. Hau Pham. Leurre.com: on the advantages of deploying a large scale distributed honeypot platform. In Proc. of ECCE'05, E-Crime and Computer Conference, Monaco, 2005.
6. Home page of Leurre.com: http://www.leurre.org.
7. Project Leurre.com. Publications web page: http://www.leurrecom.org/ paper.htm.
8. th IEEE Pacific Rim Int. Symp., pp. 383-388, Tahiti, 2004.
9. th IEEE Int. Real-Time Systems Symp. (RTSS 04)), Lisboa, Portugal, 2004.
10. E. Alata, V. Nicomette, M. Kaaniche, M. Dacier, M. Herrb, Lessons learned from the deployment of a high-interaction honeypot: Extended version. LAAS Report, July 2006.
11. Inc. VMware. Available on: http://www.vmware.com
12. The PaX Team. Available on: http://pax.grsecurity.net.
13. EnergyMech team. Energymech. Available on: http://www.energymech.net.
14. US-CERT. Linux kernel mremap(2) system call does not properly check return value from do_munmap() function. Available on: http://www.kb.cert.org/ vuls/id/981222.
15. US-CERT. Linux kernel do_brk() function contains integer overflow, http://www.kb.cert.org/vuls/id/981222.
16. J. Corey, Advanced honeypot identification and exploitation. Phrack, N 63, Available on: http://www.phrack.org/fakes/p63/p63-0x09.txt.
17. T. Holz and F. Raynal, Detecting honeypots and other suspicious environments. In Systems, Man and Cybernetics (SMC) Information Assurance Workshop. Proc. from the Sixth Annual IEEE, pages 29-36, 2005.