Honeypots That Bite Back: A Fuzzy Technique for Identifying and Inhibiting Fingerprinting Attacks on Low Interaction Honeypots: A fuzzy technique for identifying and inhibiting fingerprinting attacks on low interaction honeypots

Nitin Naik, Paul Jenkins, Roger Cooke, Longzhi Yang

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

11 Citations (Scopus)
100 Downloads (Pure)

Abstract

The development of a robust strategy for network security is reliant upon a combination of in-house expertise and for completeness attack vectors used by attackers. A honeypot is one of the most popular mechanisms used to gather information about attacks and attackers. However, low-interaction honeypots only emulate an operating system and services, and are more prone to a fingerprinting attack, resulting in severe consequences such as revealing the identity of the honeypot and thus ending the usefulness of the honeypot forever, or worse, enabling it to be converted into a bot used to attack others. A number of tools and techniques are available both to fingerprint low-interaction honeypots and to defend against such fingerprinting; however, there is an absence of fingerprinting techniques to identify the characteristics and behaviours that indicate fingerprinting is occurring. Therefore, this paper proposes a fuzzy technique to correlate the attack actions and predict the probability that an attack is a fingerprinting attack on the honeypot. Initially, an experimental assessment of the fingerprinting attack on the lowinteraction honeypot is performed, and a fingerprinting detection mechanism is proposed that includes the underlying principles of popular fingerprinting attack tools. This implementation is based on a popular and commercially available low-interaction honeypot for Windows - KFSensor. However, the proposed fuzzy technique is a general technique and can be used with any low-interaction honeypot to aid in the identification of the fingerprinting attack whilst it is occurring; thus protecting the honeypot from the fingerprinting attack and extending its life.
Original languageEnglish
Title of host publication2018 IEEE International Conference on Fuzzy Systems (FUZZ-IEEE)
PublisherIEEE
ISBN (Electronic)978-1-5090-6020-7
ISBN (Print)978-1-5090-6021-4
DOIs
Publication statusPublished - 15 Oct 2018
EventIEEE World Congress on Computational Intelligence 2018 - Windsor Barra Convention Centre, Rio de Janeiro, Brazil
Duration: 8 Jul 201813 Jul 2018

Conference

ConferenceIEEE World Congress on Computational Intelligence 2018
Abbreviated titleWCCI 2018
CountryBrazil
CityRio de Janeiro
Period8/07/1813/07/18

Fingerprint

Dive into the research topics of 'Honeypots That Bite Back: A Fuzzy Technique for Identifying and Inhibiting Fingerprinting Attacks on Low Interaction Honeypots: A fuzzy technique for identifying and inhibiting fingerprinting attacks on low interaction honeypots'. Together they form a unique fingerprint.

Cite this