A proactive approach to intrusion detection and malware collection

Chia Mei Chen, Sheng Tzong Cheng, Ruei Yu Zeng

研究成果: Article同行評審

7 引文 斯高帕斯(Scopus)

摘要

Network continues to be under various attacks every day. One common attack is to use password guessing to intrude a machine and then to inject malware or botnet for future control. To develop counter measures, honeypot technique, which simulates a real system, is often used for capturing attack patterns, malware or botnet, and malware download sites. However, neither low-interaction nor medium-interaction honeypot could simulate well the behaviors in a true system as a result of the inborn restrictions in the technology so that the honeypot might be discovered by an attacker or malware. This study proposes a new honeypot system, Jingu, which is constructed with a true environment plus protection mechanism from being circumvented. The proposed high-interactive honeypot system, Jingu, can achieve the following goals: (1) not be perceived by attackers; (2) to protect against being attacked; (3) to record and learn attack behaviors; (4) to capture malware; and (5) to collect valuable information for detection purpose. Jingu has been deployed on a real network for 2years. Comparing with the low-interactive honeypot, honeyd, Jingu can successfully catch attack behaviors as well as can capture malware. The results show that the proposed system is able to block real attacks and to collect valuable information for future detection and malware analysis.

原文English
頁(從 - 到)844-853
頁數10
期刊Security and Communication Networks
6
發行號7
DOIs
出版狀態Published - 2013 七月

All Science Journal Classification (ASJC) codes

  • Information Systems
  • Computer Networks and Communications

指紋 深入研究「A proactive approach to intrusion detection and malware collection」主題。共同形成了獨特的指紋。

引用此