A computational intelligence enabled honeypot for chasing ghosts in the wires

Abstract

A honeypot is a concealed security system that functions as a decoy to entice cyberattackers to reveal their information. Therefore, it is essential to disguise its identity to ensure its successful operation. Nonetheless, cyberattackers frequently attempt to uncover these honeypots; one of the most effective techniques for revealing their identity is a fingerprinting attack. Once identified, a honeypot can be exploited as a zombie by an attacker to attack others. Several effective techniques are available to prevent a fingerprinting attack, however, that would be contrary to the purpose of a honeypot, which is designed to interact with attackers to attempt to discover information relating to them. A technique to discover any attempted fingerprinting attack is highly desirable, for honeypots, while interacting with cyberattackers. Unfortunately, no specific method is available to detect and predict an attempted fingerprinting attack in real-time due to the difficulty of isolating it from other attacks. This paper presents a computational intelligence enabled honeypot that is capable of discovering and predicting an attempted fingerprinting attack by using a Principal components analysis and Fuzzy inference system. This proposed system is successfully tested against the five popular fingerprinting tools Nmap, Xprobe2, NetScanTools Pro, SinFP3 and Nessus.

Implementasi HoneyPy Dengan Malicious Traffic Detection System (Maltrail) Menggunakan Analisis Deskriptif Guna Untuk Mendeteksi Serangan DDOS Pada Server

“…HIHAT adalah contoh aplikasi web honeypot dengan tingkat interaksi yang tinggi. HIHAT mengubah aplikasi PHP menjadi honeypot dengan interaksi tinggi [12]. Gambar 1.…”

The impacts of artificial intelligence techniques in augmentation of cybersecurity: a comprehensive review

“…Naik et al [65], proposed a computational intelligence honeypot system that was capable of predicting and discovering the attempted fingerprinting attack. The proposed intelligent system used two approaches Principal Component Analysis which was used to select the most important features for the prediction, and Fuzzy Inference System (FIS) which was used to correctly correlate the selected features by the Principal Component Analysis.…”

Fuzzy Hashing Aided Enhanced YARA Rules for Malware Triaging

“…Forensic analysis of malware requires a thorough knowledge of the degree of similarity between known malware and inert files to assess files for their threat potential. This is especially important when considering the analysis and clustering of suspected malware in order to discover new variants [19]. As a result, the use of the similarity preserving property of fuzzy hashing is useful in malware analysis while comparing unknown files with known malware families, where samples possess similar functionality, yet different cryptographic hash values [2].…”