HoneyStat: Local Worm Detection Using Honeypots

Dagon, David; Qin, Xinzhou; Gu, Guofei; Lee, Wenke; Grizzard, J.B.; Levine, John G.; Owen, Henry L.

doi:10.1007/978-3-540-30143-1_3

Cited by 120 publications

(52 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Honeypots [43] are fake computer systems intended to bait malicious actions that will be tracked and studied once these systems are probed or compromised. Honeypots are widely used in intrusion detection system [44], [45], [46]. Similarly, a honeynet [47] is proposed to assist the system administrator in identifying malicious traffic on the enterprise network.…”

Section: Related Workmentioning

confidence: 99%

GenoGuard: Protecting Genomic Data against Brute-Force Attacks

Huang

Ayday

Fellay

et al. 2015

2015 IEEE Symposium on Security and Privacy

View full text Add to dashboard Cite

Abstract-Secure storage of genomic data is of great and increasing importance. The scientific community's improving ability to interpret individuals' genetic materials and the growing size of genetic database populations have been aggravating the potential consequences of data breaches. The prevalent use of passwords to generate encryption keys thus poses an especially serious problem when applied to genetic data. Weak passwords can jeopardize genetic data in the short term, but given the multidecade lifespan of genetic data, even the use of strong passwords with conventional encryption can lead to compromise.We present a tool, called GenoGuard, for providing strong protection for genomic data both today and in the long term. GenoGuard incorporates a new theoretical framework for encryption called honey encryption (HE): it can provide information-theoretic confidentiality guarantees for encrypted data. Previously proposed HE schemes, however, can be applied to messages from, unfortunately, a very restricted set of probability distributions. Therefore, GenoGuard addresses the open problem of applying HE techniques to the highly non-uniform probability distributions that characterize sequences of genetic data.In GenoGuard, a potential adversary can attempt exhaustively to guess keys or passwords and decrypt via a bruteforce attack. We prove that decryption under any key will yield a plausible genome sequence, and that GenoGuard offers an information-theoretic security guarantee against messagerecovery attacks. We also explore attacks that use side information. Finally, we present an efficient and parallelized software implementation of GenoGuard.

show abstract

Section: Related Workmentioning

confidence: 99%

GenoGuard: Protecting Genomic Data against Brute-Force Attacks

Huang

Ayday

Fellay

et al. 2015

2015 IEEE Symposium on Security and Privacy

View full text Add to dashboard Cite

show abstract

“…Provos (Provos, 2004) presented "honeyd," a honeypot software package that makes large-scale honeynet monitoring possible. Dagon et al (Dagon et al, 2004) presented the "HoneyStat" system to use coordinated honeypots to detect worm infections in local networks. Jiang and Xu (Jiang and Xu, 2004) presented a virtual honeynet system that has a distributed presence and centralized operation.…”

Section: Related Workmentioning

confidence: 99%

“…A "honeypot " is a special constructed computer or network trap designed to attract and detect malicious attacks (Honeypot, 2009). In recent years, honeypots have become popular, and security researchers have generated many successful honeypot-based attack analysis and detection systems (such as Anagnostakis et al (2005); Dagon et al (2004); Jiang and Xu (2004); Levine et al (2003); Provos (2004); Rajab et al (2007); Vrable et al (2005).) As more people begin to use honeypots in monitoring and defense systems, botmasters constructing and maintaining botnets will sooner or later try to find ways to avoid honeypot traps.…”

mentioning

confidence: 99%

Honeypot detection in advanced botnet attacks

Wang

Cunningham

et al. 2010

IJICS

View full text Add to dashboard Cite

Botnets have become one of the major attacks in current Internet due to their illicit profitable financial gain. Meanwhile, honeypots have been successfully deployed in many computer security defense systems. Since honeypots set up by security defenders can attract botnet compromises and become spies in exposing botnet membership and botnet attacker behaviors, they are widely used by security defenders in botnet defense. Therefore, attackers constructing and maintaining botnets will be forced to find ways to avoid honeypot traps. In this paper, we present a hardware and software independent honeypot detection methodology based on the following assumption: security professionals deploying honeypots have liability constraint such that they cannot allow their honeypots to participate in real attacks that could cause damage to others, while attackers do not need to follow this constraint. Attackers could detect honeypots in their botnets by checking whether compromised machines in a botnet can successfully send out unmodified malicious traffic. Based on this basic detection principle, we present honeypot detection techniques to be used in both centralized botnets and peer-to-peer structured botnets. Experiments show that current standard honeypot and honeynet programs are vulnerable to the proposed honeypot detection techniques. In the end, we discuss some guidelines for defending against general honeypot-aware attacks.

show abstract

“…Gu et al [10] discussed worm containment in local network using a small address space. Dagon et al [7] discuss a multi-parameter based worm detection mechanism using honeypots.…”

Section: Background and Related Workmentioning

confidence: 99%

Effective worm detection for various scan techniques

Xia

Vangala

et al. 2006

JCS

View full text Add to dashboard Cite

Abstract-In recent years, the threats and damages caused by active worms have become more and more serious. In order to reduce the loss caused by fastspreading active worms, an effective detection mechanism to quickly detect worms is desired. In this paper, we first explore various scan strategies used by worms on finding vulnerable hosts. We show that targeted worms spread much faster than random scan worms. We then present a generic worm detection architecture to monitor malicious worm activities. We propose and evaluate our detection mechanism called Victim Number Based Algorithm. We show that our detection algorithm is effective and able to detect worm events before 2% of vulnerable hosts are infected for most scenarios. Furthermore, in order to reduce false alarms, we propose an integrated approach using multiple parameters as indicators to detect worm events. The results suggest that our integrated approach can differentiate worm attacks from DDoS attacks and benign scans.

show abstract

HoneyStat: Local Worm Detection Using Honeypots

Cited by 120 publications

References 21 publications

GenoGuard: Protecting Genomic Data against Brute-Force Attacks

GenoGuard: Protecting Genomic Data against Brute-Force Attacks

Honeypot detection in advanced botnet attacks

Effective worm detection for various scan techniques

Contact Info

Product

Resources

About