Search

In this paper, a honeynet is deployed with the help of container based virtualisation technology to gain comprehensive information on the actions against the network. The honeynet is deployed using a University Putra Malaysia (UPM) specific internet protocol (IP) address to attract attention from internet users and network data is then gathered from the scans performed on the honeynet for a period of two weeks. The data is then analysed to determine the patterns of activity based on port scans, Secure Shell (SSH) connection attempts and the variety of operating systems where the attacks initiated from. Windows XP was found to be the primary choice for infection by the hackers as Microsoft stopped issuing security updates for this particular platform, while Linux systems are less infected due to frequent security upgrades. Interestingly, US and Russian based IP addresses poked the SSH server the most, followed by Malaysian IP addresses. [ABSTRACT FROM AUTHOR]

Honeynet represents a theory in network protection. Unlike purely defensive methods, such as intrusion detection systems (IDS), data encryption and firewalls, that try to avoid interaction with the attacker, Honeynet is based on the idea of interaction with the attacker. During this interaction, Honeynet records all of the attacker's actions and tools used without the attacker knowing. This data is sent to security analysers to study and prepare defensive methods. Honeynet can also protect physical computers and infrastructure by duplicating them virtually and presenting this virtual environment instead of the real systems to any person trying to gain unauthorised access to the network. In this work, a hybrid Honeynet, including both the low- and high-interaction honeypots, was developed and implemented utilising virtualisation technology to represent a typical laboratory environment in University Putra Malaysia (UPM). Different virtualisation methods were evaluated based on their ability to deploy a stable Honeynet, with Linux containers (LXC) proving to be more efficient in deploying a large scale Honeynet as compared to other virtualisation methods. [ABSTRACT FROM AUTHOR]