Siphon

Guarnizo, Juan; Tambe, Amit; Bhunia, Suman Sankar; Ochoa, Martín; Tippenhauer, Nils Ole; Shabtai, Asaf; Elovici, Yuval

doi:10.1145/3055186.3055192

Cited by 78 publications

(13 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Phype [7] Telnet medium Cowrie [8] Telnet medium IoTCandyJar [10] multiple very high Honware [11] multiple very high IoTPOT [9] multiple high SIPHON [12] SSH, HTTP high ThingPot [13] HTTP, XMPP medium Multi-purpose IoT Honeypot [14] multiple high HoneyThing [15] TR-064 low Smart Factory Honeypot [64] multiple varying…”

Section: Simulated Service(s) Interactionmentioning

confidence: 99%

An Automated and Comprehensive Framework for IoT Botnet Detection and Analysis (IoT-BDA)

Trajanovski¹,

Zhang

2021

IEEE Access

View full text Add to dashboard Cite

The proliferation of insecure Internet-connected devices gave rise to the IoT botnets which can grow very large rapidly and may perform high-impact cyber-attacks. The related studies for tackling IoT botnets are concerned with either capturing or analyzing IoT botnet samples, using honeypots and sandboxes, respectively. The lack of integration between the two implies that the samples captured by the honeypots must be manually submitted for analysis in sandboxes, introducing a delay during which a botnet may change its operation. Furthermore, the effectiveness of the proposed sandboxes is limited by the potential use of anti-analysis techniques and the inability to identify features for effective detection and identification of IoT botnets. In this paper, we propose and evaluate a novel framework, the IoT-BDA framework, for automated capturing, analysis, identification, and reporting of IoT botnets. The framework consists of honeypots integrated with a novel sandbox that supports a wider range of hardware and software configurations, and can identify indicators of compromise and attack, along with anti-analysis, persistence, and anti-forensics techniques. These features can make botnet detection and analysis, and infection remedy more effective. The framework reports the findings to a blacklist and abuse service to facilitate botnet suspension. The paper also describes the discovered anti-honeypot techniques and the measures applied to reduce the risk of honeypot detection. Over the period of seven months, the framework captured, analyzed, and reported 4077 unique IoT botnet samples. The analysis results show that some IoT botnets used antianalysis, persistence, and anti-forensics techniques typically seen in traditional botnets.

show abstract

Section: Simulated Service(s) Interactionmentioning

confidence: 99%

An Automated and Comprehensive Framework for IoT Botnet Detection and Analysis (IoT-BDA)

Trajanovski¹,

Zhang

2021

IEEE Access

View full text Add to dashboard Cite

show abstract

“…J. Guarnizo et al depict a new IoT honeypot-based scalable architecture named SIPHON. They basically suggest a system composed of real IoT devices in a setup that enables to collect information on attacks from different geo-locations [30].…”

Section: Iot Honeypot Systemsmentioning

confidence: 99%

On the rewards of self-adaptive IoT honeypots

et al. 2019

View full text Add to dashboard Cite

In an era of fully digitally interconnected people and machines, IoT devices become a real target for attackers. Recent incidents such as the well-known Mirai botnet, have shown that the risks incurred are huge and therefore a risk assessment is mandatory. In this paper we present a novel approach on collecting relevant data about IoT attacks. We detail a SSH/Telnet honeypot system that leverages reinforcement learning algorithms in order to interact with the attackers, and we present the results obtained in view of defining optimal reward functions to be used. One of the key issues regarding the performance of such algorithms is the direct dependence on the reward functions used. The main outcome of our study is a full implementation of an IoT honeypot system that leverages Apprenticeship Learning using Inverse Reinforcement Learning, in order to generate best suited reward functions.

show abstract

“…• SIPHON is a high-interaction honeypot for IoT devices. In [14], the authors designed a network architecture to monitor and collect IoT attacks by establishing secure VPN tunnels between the deployed forwarding machine and the physical devices. • Nepenthes is a low interaction honeypot and emulates network vulnerabilities that worms exploit to spread.…”

Section: Honeypotsmentioning

confidence: 99%

HoneyThing: A New Honeypot Design for CPE Devices

2018

KSII TIIS

View full text Add to dashboard Cite

The Internet of Things (IoT) has become an emerging industry that is broadly used in many fields from industrial and agricultural manufacturing to home automation and hospitality industry. Because of the sheer number of connected devices transmitting valuable data, the IoT infrastructures have become a main target for cyber-criminals. One of the key challenges in protecting IoT devices is the lack of security measures by design. Although there are many hardware and software based security solutions (firewalls, honeypots, IPDS, anti-virus etc.) for information systems, most of these solutions cannot be applied to IoT devices because of the fact that IoT devices have limited computing resources (CPU, RAM,). In this paper, we propose a honeypot system called HoneyThing for modem/router devices (i.e. a kind of IoT device). HoneyThing emulates TR-069 protocol which is prevalent protocol used to remotely manage customer-premises equipment (CPE) devices, e.g. modems, routers. Honeything also serves an embedded web server simulating a few actual, critical vulnerabilities associated with the implementation of TR-069 protocol. To show effectiveness of the HoneyThing in capturing real world attacks, we have deployed it in the Internet. The obtained results are highly promising and facilitate to reveal network attacks targeting to CPE devices.

show abstract

Siphon

Cited by 78 publications

References 12 publications

An Automated and Comprehensive Framework for IoT Botnet Detection and Analysis (IoT-BDA)

An Automated and Comprehensive Framework for IoT Botnet Detection and Analysis (IoT-BDA)

On the rewards of self-adaptive IoT honeypots

HoneyThing: A New Honeypot Design for CPE Devices

Contact Info

Product

Resources

About