A virtual honeypot framework

Proceedings of the 13th USENIX Security Symposium

Volumn , Issue , 2004, Pages

  Provos, Niels ^a  

^a GOOGLE INC   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

COMPUTER NETWORKS;

ARBITRARY NUMBER; EARLY WARNING; NETWORK ADDRESS; PHYSICAL SYSTEMS; ROUTING TOPOLOGY; SPECIALIZED HARDWARE; SYSTEM SECURITY; VIRTUAL SYSTEMS;

NETWORK SECURITY;

EID: 85084163190     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (29)

1. Ofir Arkin and Fyodor Yarochkin. Xprobe v2.0: A "Fuzzy" Approach to Remote Active Operating System Fingerprinting. www.xprobe2.org, August 2002.
2. Steven M. Bellovin. Security problems in the TCP/IP protocol suite. Computer Communications Review, 19:2:32-48, 1989.
3. Smoot Carl-Mitchell and John S. Quarterman. Using ARP to Implement Transparent Subnet Gateways. RFC 1027, October 1987.
4. CERT. Cert advisory ca-2001-26 nimda worm. www.cert.org/advisories/CA-2001-26.html, September 2001.
5. CERT. Cert advisory ca-2003-20 w32/blaster worm. www.cert.org/advisories/CA-2003-20.html, August 2003.
6. Fred Cohen. The Deception Toolkit. http://all.net/dtk.html, March 1998. Viewed on May 12th, 2004.
7. George W. Dunlap, Samuel T. King, Sukru Cinar, Murtaza Basrai, and Peter M. Chen. ReVirt: Enabling Intrusion Analysis through Virtual-Machine Logging and Replay. In Proceedings of the 2002 Symposium on Operating Systems Design and Implementation, December 2002.
8. Kevin Fall. Network Emulation in the VINT/NS Simulator. In Proceedings of the fourth IEEE Symposium on Computers and Communications, July 1999.
9. Fyodor. Remote OS Detection via TCP/IP Stack Fingerprinting. www.nmap.org/nmap/nmap-fingerprinting-article.html, October 1998.
10. S. Glassman. A Caching Relay for the World Wide Web. In Proceedings of the First International World Wide Web Conference, pages 69-76, May 1994.
11. S. Hanks, T. Li, D. Farinacci, and P. Traina. Generic Routing Encapsulation (GRE). RFC 1701, October 1994.
12. S. Hanks, T. Li, D. Farinacci, and P. Traina. Generic Routing Encapsulation over IPv4 networks. RFC 1702, October 1994.
13. Herbert W. Hethcote. The Mathematics of Infectious Diseases. SIAM Review, 42(4):599-653, 2000.
14. C. Kreibich and J. Crowcroft. Automated NIDS Signature Generation using Honeypots. Poster paper, ACM SIGCOMM 2003, August 2003.
15. D. Moore, C. Shannon, and J. Brown. Code-Red: A Case Study on The Spread and Victims of an Internet Worm. In Proceedings of the 2nd ACM Internet Measurement Workshop, pages 273-284. ACM Press, November 2002.
16. David Moore, Vern Paxson, Stefan Savage, Colleen Shannon, Stuart Staniford, and Nicholas Weaver. Inside the Slammer Worm. IEEE Security and Privacy, 1(4):33-39, July 2003.
17. David Moore, Colleen Shannon, Geoffrey Voelker, and Stefan Savage. Internet Quarantine: Requirements for Containing Self-Propagating Code. In Proceedings of the 2003 IEEE Infocom Conference, April 2003.
18. Laurent Oudot. Fighting worms with honeypots: honeyd vs msblast.exe. lists.insecure.org/lists/honeypots/2003/Jul-Sep/0071.html, August 2003. Honeypots mailinglist.
19. Vern Paxson. Bro: A System for Detecting Network Intruders in Real-Time. In Proceedings of the 7th USENIX Security Symposium, January 1998.
20. Jon Postel. Transmission Control Protocol. RFC 793, September 1981.
21. Thomas Ptacek and Timothy Newsham. Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection. Secure Networks Whitepaper, August 1998.
22. Matthew Smart, G. Robert Malan, and Farnam Jahanian. Defeating TCP/IP Stack Fingerprinting. In Proceedings of the 9th USENIX Security Symposium, August 2000.
23. Dug Song, Robert Malan, and Robert Stone. A Snapshot of Global Worm Activity. Technical report, Arbor Networks, November 2001.
24. Lance Spitzner. Honeypots: Tracking Hackers. Addison Wesley Professional, September 2002.
25. Stuart Staniford, Vern Paxson, and Nicholas Weaver. How to 0wn the Internet in your Spare Time. In Proceedings of the 11th USENIX Secuirty Symposium, August 2002.
26. W. R. Stevens. TCP/IP Illustrated, Volume 1. Addison-Wesley, 1994.
27. Jeremy Sugerman, Ganesh Venkitachalam, and Beng-Hong Lim. Virtualizing I/O Devices on VMware Workstation's Hosted Virtual Machine Monitor. In Proceedings of the Annual USENIX Technical Conference, pages 25-30, June 2001.
28. David Wagner and Paolo Soto. Mimicry Attacks on Host-Based Intrusion Detection Systems. In Proceedings of the 9th ACM Conference on Computer and Communications Security, November 2002.
29. Michal Zalewski and William Stearns. Passive OS Fingerprinting Tool. www.stearns.org/p0f/README. Viewed on January 12th, 2003.