Analysis of Network Intrusion Attacks using Honeypots

Abstract

Network intrusion attacks are performed quite immensely these days. Malicious intruder performs attacks on the infrastructure of a network of organizations. The increase in the number of various intruders and different attacks has made mitigation and security implementation a hard task to be achieved. In order to accomplish felonious access over server, attackers target Secure Shell service. In this paper, an intrusion detection operation and web trap for an intruder is performed on SSH service. A fake file system is created which will camouflage itself as the original root. A honeypot system which remains an effective environment in gathering intelligence about the intruder is used and information which is highly sufficient in the identification of the attacker is collected. In this, the honeypot is used to by-port the main SSH port and run the fake file system of the honeypot in the main port to mislead and trap the details of the intruder. By the end of the process, reports and play logs will be generated on the performed attacks which would be useful for further research phase. Visualization tools would further help in the analysis of the activity of the attacker.