A Method to Prevent Known Attacks and Their Variants by Combining Honeypots and IPS

Yamamoto, Yudai; Yamaguchi, Shingo

doi:10.1109/gcce56475.2022.10014099

Cited by 1 publication

(1 citation statement)

References 2 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In our previous method [9], we proposed an autonomous defense system and showed its effectiveness against both known attacks and variant attacks, but focused on attack detection and not rules generation. In this paper, we aim to target not only the detection of attacks, but also the generation of rules.…”

Section: Autonomous Defense Systemmentioning

confidence: 99%

Defense Mechanism to Generate IPS Rules from Honeypot Logs and Its Application to Log4Shell Attack and Its Variants

Yamamoto

Yamaguchi

2023

Electronics

Self Cite

View full text Add to dashboard Cite

The vulnerability of Apache Log4j, Log4Shell, is known for its widespread impact; many attacks that exploit Log4Shell use obfuscated attack patterns, and Log4Shell has revealed the importance of addressing such variants. However, there is no research which focuses on the response to variants. In this paper, we propose a defense system that can protect against variants as well as known attacks. The proposed defense system can be divided into three parts: honeypots, machine learning, and rule generation. Honeypots are used to collect data, which can be used to obtain information about the latest attacks. In machine learning, the data collected by honeypots are used to determine whether it is an attack or not. It generates rules that can be applied to an IPS (Intrusion Prevention System) to block access that is determined to be an attack. To investigate the effectiveness of this system, an experiment was conducted using test data collected by honeypots, with the conventional method using Suricata, an IPS, as a comparison. Experimental results show that the discrimination performance of the proposed method against variant attacks is about 50% higher than that of the conventional method, indicating that the proposed method is an effective method against variant attacks.

show abstract

Section: Autonomous Defense Systemmentioning

confidence: 99%