On recognizing virtual honeypots and countermeasures

Proceedings - 2nd IEEE International Symposium on Dependable, Autonomic and Secure Computing, DASC 2006

Volumn , Issue , 2006, Pages 211-218

  Fu, Xinwen ^a   Yu, Wei ^a   Cheng, Dan ^a   Tan, Xuejun ^a   Streff, Kevin ^a   Graham, Steve ^a  

^a NONE

Author keywords

[No Author keywords available]

Indexed keywords

COMPUTATIONAL METHODS; COMPUTER OPERATING SYSTEMS; DECISION THEORY; INFORMATION ANALYSIS;

NEYMAN-PEARSON DECISION THEORY; PHYSICAL MACHINE; VIRTUAL HONEYPOTS;

VIRTUAL REALITY;

EID: 36949035998     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/DASC.2006.36     Document Type: Conference Paper

References (26)

1. N. Provos, "A virtual honeypot framework," in Proceedings of USENIX Security Symposium, August 2004.
2. X. Fu, W. Yu, D. Cheng, X. Tan, and S. Graham, "On recognizing virtual honeypots and countermeasures," http://www.homepages.dsu.edu/fux/, 2006.
3. J. Dike, "The user-mode linux kernel home page," http: //user-mode-linux.sourceforge.net/, 2005.
4. vmware.com, "Vmware workstation 5," http://www.vmware.com/ products/desktop/ws.features.html, 2005.
5. honeynet.org, "Honeynet project," http://www.honeynet.org/ index.html, 2005.
6. M. Dornseif, T. Holz, and C. N. Klein, "Nosebreak - attacking honeynets," in Proceedings of IEEE Workshop on Information Assurance and Security, June 2004.
7. phrack.org, "Phrack," http://www.phrack.org/, 2005.
8. T. Kohno, A. Broido, and kc claffy, "Remote physical device fingerprinting," in Proceedings of the IEEE Symposium on Security and Privacy, May 2005.
9. V. Jacobson, "Pathchar," http://www.caida.org/tools/utilities/ others/ pathchar/, 1997.
10. A. B. Downey, "Using pathchar to estimate internet link characteristics," in Proceedings of ACM SIGCOMM, September 1999.
11. _, "Clink: a tool for estimating internet link characteristics, " http: //allendowney.com/research/clink/, 1999.
12. B. A. Man, "pchar: A tool for measuring internet path characteristics," http://www.kitchenlab.org/www/bmah/Software/pchar/, 2005.
13. Computational Research Division, Lawrence Berkeley National Laboratory, "Network characterization service (NCS)," http://www-didc.lbl. gov/NCS/, 2005.
14. N. Provos, "libevent - an event notification library," http://www.monkey. org/∼provos/libevent/, 2004.
15. B. Lowekamp, D. R. OHallaron, and T. R. Gross, "Topology discovery for large ethernet networks," in Proceedings of ACM SIGCOMM, August 2001.
16. J. Corbet, A. Rubini, and G. Kroah-Hartman, Linux Device Drivers, Third Edition. O'Reilly, 2005.
17. N. Provos, "Developments of the honeyd virtual honeypot," http://www. honeyd.org/, 2005.
18. W. R. Stevens, TCP/IP Illustrated, Volume 1 The Protocols. AddisonWesley Professional, 1999.
19. B. Silverman, Density Estimation for Statistics and Data Analysis, Monographs on Statistics and Applied Probability. London: Chapman & Hall, 1986.
20. C. Beardah, "Kernel density estimation toolbox," http://web.ccr.jussieu. fr/ccr/Documentation/Calcul/matlab5vll/docs/00053/05375. htm, 1999.
21. R. O. Duda and P. E. Hart, Pattern Classification. John Wiley & Sons, 2001.
22. M. Carson and D. Santay, "Nist net - a linux-based network emulation tool," Computer Communication Review, vol. 33, no. 3, July 2003.
23. S. Keshav, C. Estan, H. Chan, and W. Chang, "Project argus network topology discovery, monitoring, history, and visualization," http://www.cs.cornell.edu/boom/1999sp/projects/Network%20Topology/ topology.html, 1999.
24. TimeSys Corp. , "Timesys," http://www.timesys.com/, 2005.
25. G. Anzinger, "This is the home page for the high resolution timers project," http://high-res-timers.sourceforge.net/, 2005.
26. J.-M. Valin, "Increasing hz (patch for hz > 1000)" http://kerneltrap.org/ node/1766, 2003.