A proactive approach to intrusion detection and malware collection

Chia Mei Chen, Sheng Tzong Cheng, Ruei Yu Zeng

Research output: Contribution to journalArticlepeer-review

7 Citations (Scopus)

Abstract

Network continues to be under various attacks every day. One common attack is to use password guessing to intrude a machine and then to inject malware or botnet for future control. To develop counter measures, honeypot technique, which simulates a real system, is often used for capturing attack patterns, malware or botnet, and malware download sites. However, neither low-interaction nor medium-interaction honeypot could simulate well the behaviors in a true system as a result of the inborn restrictions in the technology so that the honeypot might be discovered by an attacker or malware. This study proposes a new honeypot system, Jingu, which is constructed with a true environment plus protection mechanism from being circumvented. The proposed high-interactive honeypot system, Jingu, can achieve the following goals: (1) not be perceived by attackers; (2) to protect against being attacked; (3) to record and learn attack behaviors; (4) to capture malware; and (5) to collect valuable information for detection purpose. Jingu has been deployed on a real network for 2years. Comparing with the low-interactive honeypot, honeyd, Jingu can successfully catch attack behaviors as well as can capture malware. The results show that the proposed system is able to block real attacks and to collect valuable information for future detection and malware analysis.

Original languageEnglish
Pages (from-to)844-853
Number of pages10
JournalSecurity and Communication Networks
Volume6
Issue number7
DOIs
Publication statusPublished - 2013 Jul

All Science Journal Classification (ASJC) codes

  • Information Systems
  • Computer Networks and Communications

Fingerprint Dive into the research topics of 'A proactive approach to intrusion detection and malware collection'. Together they form a unique fingerprint.

Cite this