An Adaptive Honeypot System to Capture IPv6 Address Scans

Hyhoneydv6: A hybrid Honeypot Architecture for IPv6 Networks

“…Nine of the eleven architectures do not support or consider IPv6 networks at all. The only other architecture with IPv6 support is presented by Kishimoto et al [11]. However, the presented solution relies on the IPv6 Neighbour Discovery (ND) protocol which limits its applicability to /64-networks, whereas Hyhoneydv6 supports arbitrarily large IPv6 networks.…”

“…Potemkin implements traffic filters to filter out uninteresting traffic like network scans in order to limit the number of dynamically created machines. The architecture presented by Kishimoto et al restricts the instantiation of new machines to addresses which are generated using the default EUI-64 algorithm [11]. Therefore, networks scans targeting arbitrary address spaces, which may include addresses generated with IPv6 privacy extensions [13], will never cause the instantiation of a machine.…”

“…The Potemkin honeyfarm architecture [17] and the architecture presented by Kishimoto et al [11] dynamically instantiate new machines on-demand. Both architectures deploy highinteraction honeypots based on incoming requests without the utilization of low-interaction honeypots.…”

“…It employs a sophisticated cloning and data transfer mechanism, called flash cloning and delta virtualization, to rapidly clone an already running base machine. The IPv6-specialized architecture presented by Kishimoto et al [11] starts a number of virtual machinebased high-interaction honeypots in advance. An IPv6 router with ND-support connects these high-interaction honeypots to the Internet.…”

Attention

“…There has been research work in the area of Dynamic Honeypot commissioning by [14] where a Honeypot would be deployed upon detecting an address scan targeting an unallocated IP address. Honeypots to be commissioned are virtual machines, based on the MAC address inferred from a NS message, the most appropriate virtual machine in terms of OS etc.…”