HoneyDOC: An Efficient Honeypot Architecture Enabling All-Round Design

Fan, Wenjun; Du, Z.; Smith-Creasey, Max; Fernández, David

doi:10.1109/jsac.2019.2894307

Cited by 43 publications

(19 citation statements)

References 38 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Owing to the SMEs running their VMs as honeypots [10], any connection attempt to them is suspicious. Honeypots are often used to investigate new attacks by filtering repeated and uninteresting connections [11]. We did find that the collaborative analysis results reveal more new attacks than the individual analysis results.…”

Section: Experimental Validationmentioning

confidence: 71%

Enabling Privacy-Preserving Sharing of Cyber Threat Information in the Cloud

Fan

Ziembicka

Lemos

et al. 2019

2019 6th IEEE International Conference on Cyber Security and Cloud Computing (CSCloud)/ 2019 5th IEEE International Conference

Self Cite

View full text Add to dashboard Cite

show abstract

Section: Experimental Validationmentioning

confidence: 71%

Enabling Privacy-Preserving Sharing of Cyber Threat Information in the Cloud

Fan

Ziembicka

Lemos

et al. 2019

2019 6th IEEE International Conference on Cyber Security and Cloud Computing (CSCloud)/ 2019 5th IEEE International Conference

Self Cite

View full text Add to dashboard Cite

show abstract

“…Fan et al [5] proposed a novel honeypot architecture called HoneyDOC to support all-round honeypot design and implementation. HoneyDOC consists of collaborative modules such as decoy, captor, and orchestrator.…”

Section: A Honeypotmentioning

confidence: 99%

Design of Intrusion Detection Honeypot Using Social Leopard Algorithm to Detect IoT Ransomware Attacks

et al. 2020

View full text Add to dashboard Cite

In recent times, ransomware has become the most significant cyber-attack targeting individuals, enterprises, healthcare industries, and the Internet of Things (IoT). Existing security systems like Intrusion Detection and Prevention System (IDPS) and Anti-virus (AV) as a single monitoring agent is complicated and timeconsuming, thus fails in ransomware detection. A robust Intrusion Detection Honeypot (IDH) is proposed to address the issues mentioned above. IDH consists of i) Honeyfolder, ii) Audit Watch, and iii) Complex Event Processing (CEP). Honeyfolder is a decoy folder modeled using Social Leopard Algorithm (SoLA), especially for getting attacked and acting as an early warning system to alert the user during the suspicious file activities. AuditWatch is an Entropy module that verifies the entropy of the files and folders. CEP engine is used to aggregate data from different security systems to confirm the ransomware behavior, attack pattern, and promptly respond to them. The proposed IDH is experimentally tested in a secured testbed using more than 20 variants of recent ransomware of all types. The experimental result confirms that the proposed IDH significantly improves the ransomware detection time, rate, and accuracy compared with the existing state of the art ransomware detection model.

show abstract

“…In addition, they use a blockchain platform to decentralize the system and store port access data by providing a private chain. Fan, W. and Du, Z. et al [17] propose a novel honeypot architecture called HoneyDOC to support a full range of honeypot design and implementation. The HoneyDOC architecture clearly identifies three basic independent and collaborative modules: baits, traps, and coordinators.…”

Section: Honeypot and Ipv6mentioning

confidence: 99%

A Web-Based Honeypot in IPv6 to Enhance Security

et al. 2020

View full text Add to dashboard Cite

IPv6 is a next-generation IP protocol that replaces IPv4. It not only expands the number of network address resources but also solves the problem of multiple access devices connected to the Internet. While IPv6 has brought excellent convenience to the public, related security issues have gradually emerged, and an assessment of the security situation in IPv6 has also become more important. Unlike passive defense, the honeypot is a security device for active defense. The real network application and the fake network application, disguised by the honeypot, are located on a similar subnet, and provide a network application service; but, in both cases, behavior logs from unauthorized users are caught. In this manner, and to protect web-based applications from attacks, this article introduces the design and implementation of a web-based honeypot that includes a weak password module and an SQL inject module, which supports the IPv6 network to capture unauthorized access behavior. We also propose the Security Situation Index (SSI), which can measure the security situation of the network application environment. The value of SSI is established according to the different parameters that are based on honeypots. There is a firewall outside the test system environment, so the obtained data should be used as the real invasion data, and the captured behavior is not a false positive. Threats can be spotted smartly by deploying honeypots; this paper demonstrates that the honeypot is an excellent method of capturing malicious requests and can be measured with the SSI of the whole system. According to the information, the administrator can modify the current security policy, which can improve the security level of a whole IPv6 network system.

show abstract

HoneyDOC: An Efficient Honeypot Architecture Enabling All-Round Design

Abstract: The version in the Kent Academic Repository may differ from the final published version. Users are advised to check http://kar.kent.ac.uk for the status of the paper. Users should always cite the published version of record.

Cited by 43 publications

References 38 publications

Enabling Privacy-Preserving Sharing of Cyber Threat Information in the Cloud

Enabling Privacy-Preserving Sharing of Cyber Threat Information in the Cloud

Design of Intrusion Detection Honeypot Using Social Leopard Algorithm to Detect IoT Ransomware Attacks

A Web-Based Honeypot in IPv6 to Enhance Security

Contact Info

Product

Resources

About