A proactive approach to intrusion detection and malware collection

Chia Mei Chen, Sheng Tzong Cheng, Ruei Yu Zeng

研究成果: Article同行評審

7 引文 斯高帕斯(Scopus)


Network continues to be under various attacks every day. One common attack is to use password guessing to intrude a machine and then to inject malware or botnet for future control. To develop counter measures, honeypot technique, which simulates a real system, is often used for capturing attack patterns, malware or botnet, and malware download sites. However, neither low-interaction nor medium-interaction honeypot could simulate well the behaviors in a true system as a result of the inborn restrictions in the technology so that the honeypot might be discovered by an attacker or malware. This study proposes a new honeypot system, Jingu, which is constructed with a true environment plus protection mechanism from being circumvented. The proposed high-interactive honeypot system, Jingu, can achieve the following goals: (1) not be perceived by attackers; (2) to protect against being attacked; (3) to record and learn attack behaviors; (4) to capture malware; and (5) to collect valuable information for detection purpose. Jingu has been deployed on a real network for 2years. Comparing with the low-interactive honeypot, honeyd, Jingu can successfully catch attack behaviors as well as can capture malware. The results show that the proposed system is able to block real attacks and to collect valuable information for future detection and malware analysis.

頁(從 - 到)844-853
期刊Security and Communication Networks
出版狀態Published - 2013 七月

All Science Journal Classification (ASJC) codes

  • 資訊系統
  • 電腦網路與通信


深入研究「A proactive approach to intrusion detection and malware collection」主題。共同形成了獨特的指紋。