Adaptive and self-configurable honeypots

Abstract

Honeypot evangelists propagate the message that honeypots are particularly useful for learning from attackers.However, by looking at current honeypots, most of them are statically configured and managed, which requires a priori knowledge about attackers. In this paper we propose a high interaction honeypot capable of learning from attackers and capable of dynamically changing its behavior using a variant of reinforcement learning. It can strategically block the execution of programs, lure the attacker by substituting programs and insult attackers with the intent of revealing the attacker's nature and ethnic background. We also investigated the fact that attackers could learn to defeat the honeypot and discovered that attacker and honey pot interests sometimes diverge.

Cloud security using self-acting spontaneous honeypots

“…Also state representation is needed to be improved. Moreover , experienced and sophisticated attackers could replace states and poison the learning process [11]. Gérard Wagener et al in , "Heliza: talking dirty to the attackers" , proposed Heliza, a self-adaptive honey pot system which uses reinforcement learning technique to interact with the attackers, self adaptability makes it to increase interaction with the attacker and gather much detailed information by using game theory & machine learning techniques.…”

Towards Deployment Strategies for Deception Systems

“…These researches can be classified in two major domains: Interaction and Deployment. Context-aware interaction focuses on decision making for DSs [15][16] [17]. The adaptive deployment domain is in an early stage compared to the first usage of DSs.…”

A review of dynamic and intelligent honeypots

“…The main challenges are in configuring and maintaining the honeypots [11][12][13] . Since a honeypot is a deception tool which attracts and lures the attackers from attacking the real production hosts, its functionality and effectiveness depend on the technical configuration.…”

“…Configuration issues include what type of operating system the honeypot will be running, how many TCP and UDP ports to offer, which network services to emulate, which IP address the honeypot will be monitoring, what the behaviour of the honeypot towww.scienceasia.org wards the attacker is, and whether it should respond to the attacker's interactions or be passive 11,13,14 .…”

“…Wagener et al approached this problem by using reinforcement learning in order to make the honeypot capable of dynamically changing its behaviour based on the attacker's interaction 11 . Apart from luring the attackers towards the honeypot, their implementation also has the ability to insult the attackers with the intention of making the attackers reveal their identity.…”