Comparative survey of local honeypot sensors to assist network forensics

P. T. Chen, C. S. Laih, F. Pouget, M. Dacier

Research output: Chapter in Book/Report/Conference proceedingConference contribution

11 Scopus citations

Abstract

This paper intends to illustrate the usefulness of deploying multiple simple honeypot sensors in a large variety of locations. Indeed, a permanent identification of anomalies that occur on a single sensor allows pinpointing abnormal local activities. These can be the manifest of misconfiguration issues or highlight attacks particular to some given environments. Both cases are important for administrators in charge of the networks hosting the sensors. We propose in this paper a comparison of simple parameters that reveal to be an easy way to determine these abnormal and particular activities. On the basis of two identical honeypot sensors that we have deployed for more than 6 months in France and in Taiwan, we detail the analysis of some anomalies that have been found against one unique sensor only. This is a preliminary but useful stage for network forensics and we intend in a near future to deploy the method over a large number of sensors. This is an on-going work and we hope that the illustrations we provide all along the paper will be a good incentive for partners to join this open project. © 2005 IEEE.
Original languageEnglish (US)
Title of host publicationProceedings - First International Workshop on Systematic Approaches to Digital Forensic Engineering
Pages120-132
Number of pages13
DOIs
StatePublished - Dec 1 2005
Externally publishedYes

Fingerprint

Dive into the research topics of 'Comparative survey of local honeypot sensors to assist network forensics'. Together they form a unique fingerprint.

Cite this