Skip to main content
SpringerLink
Log in

A Honeyfarm Data Control Mechanism and Forensic Study

  • Conference paper
  • First Online:
Communications and Networking (ChinaCom 2017)

Included in the following conference series:

  • 838 Accesses

Abstract

Honeyfarm is a model to deploy honeypots for global network attack monitoring, correlation and forensic analysis. Data control is a fundamental problem in the honeyfarm to protect the Internet from being attacked by compromised honeypots in the honeyfarm, while providing a controlled environment for worm behaviour study. However, this problem is not well addressed in a limited number of existing implementations. This paper presents a honeyfarm system and focuses on the design of a data control mechanism based on Intrusion detection and Data redirection (DOID). Comprehensive experiments including attack event tracing, worm behaviour study and forensic analysis display that DOID is a good tool for attack monitoring and forensic analysis.

The work is supported by the NSFC project 61702542 and the China Postdoctoral Science Foundation project 2016M603017.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

References

  1. Jiang, X., Xu, D., Wang, Y.-M.: Collapsar: AVM-based honeyfarm and reverse honeyfarm architecture for network attack capture and detention. J. Parallel Distrib. Comput. 66, 1165–1180 (2006)

    Article  Google Scholar 

  2. Vrable, M., Ma, J., Chen, J., Moore, D., Vandekieft, E., Snoeren, A.C., Voelker, G.M., Savage, S.: Scalability, fidelity, and containment in the potemkin virtual honeyfarm. In: Proceedings of the ACM Symposium on Operating Systems Principles. ACM, Brighton, October 2005

    Google Scholar 

  3. Spitzner, L.: Honeypots: Tracking Hackers, pp. 1–480. Addison Wesley, Boston (2002)

    Google Scholar 

  4. Burkhart, M., Schatzmann, D., Trammell, B., Boschi, E., Plattner, B.: The role of network trace anonymization under attack. SIGCOMM Comput. Commun. Rev. 40(1), 5–11 (2010)

    Article  Google Scholar 

  5. Jain, P., Sardana, A.: Defending against internet worms using honeyfarm. In: Proceedings of the CUBE International Information Technology Conference, CUBE 2012, Pune, India, pp. 795–800. ACM (2012)

    Google Scholar 

  6. Krishnan, S., Snow, K.Z., Monrose, F.: Trail of bytes: efficient support for forensic analysis. In: Proceedings of the 17th ACM CCS, Chicago, Illinois, USA, pp. 50–60. ACM (2010)

    Google Scholar 

  7. Metasploitable2. https://community.rapid7.com/docs/DOC-1875

  8. Tor technology. http://www.torproject.org/

  9. Kaur, R., Singh, M.: A survey on zero-day polymorphic worm detection techniques. IEEE Commun. Surv. Tutor. 16(3), 1520–1549 (2014)

    Article  Google Scholar 

  10. Abbasi, F.H., Harris, R.J.: Experiences with a generation III virtual honeynet. In: Proceedings of ATNAC, pp. 1–9 (2009)

    Google Scholar 

  11. Kumar, S., Singh, P., Sehgal, R., Bhatia, J.S.: Distributed honeynet system using Gen III virtual honeynet. Int. J. Comput. Theory Eng. 4(4), 537–541 (2012)

    Article  Google Scholar 

  12. Kim, I.S., Kim, M.H.: Agent-based honeynet framework for protecting servers in campus networks. IET Inf. Secur. 6(3), 202–211 (2012)

    Article  Google Scholar 

  13. He, X.-Y., Lam, K.-Y., Chung, S.-L., Chi, C.-H., Sun, J.-G.: Real-time emulation of intrusion victim in honeyfarm. In: Chi, C.-H., Lam, K.-Y. (eds.) AWCC 2004. LNCS, vol. 3309, pp. 143–154. Springer, Heidelberg (2004). https://doi.org/10.1007/978-3-540-30483-8_18

    Chapter  Google Scholar 

  14. Kreibich, C., Weaver, N., Kanich, C., Cui, W., Paxson, V.: GQ: practical containment for measuring modern malware systems. In: Proceedings of the 2011 ACM SIGCOMM IMC, Toronto, Canada, pp. 397–412. ACM (2011)

    Google Scholar 

  15. Al Fahdi, M., Clarke, N.L., Li, F., Furnell, S.M.: A suspect-oriented intelligent and automated computer forensic analysis. Digit. Invest. 18, 65–76 (2016)

    Article  Google Scholar 

  16. da Cruz Nassif, L.F., Huschka, E.R.: Document clustering for forensic analysis: an approach for improving computer inspection. IEEE Trans. Inf. Forensics Secur. 8(1), 46–54 (2013)

    Article  Google Scholar 

  17. Ovens, K.M., Morison, G.: Forensic analysis of Kik messenger on iOS devices. Digit. Invest. 17, 40–52 (2016)

    Article  Google Scholar 

  18. Walnycky, D., Baggili, I., Marrington, A., Moore, J., Breitinger, F.: Network and device forensic analysis of android social-messaging applications. Digit. Invest. 14, 77–84 (2015)

    Article  Google Scholar 

  19. Anglano, C.: Forensic analysis of whatsapp messenger on android smartphones. Digit. Invest. 11, 201–213 (2014)

    Article  Google Scholar 

  20. Vrable, M., Ma, J., Chen, J., Moore, D., Vandekieft, E., Snoeren, A.C., Voelker, G.M., Savage, S.: A forensic analysis of android malware how is malware written and how it could be detected? In: Proceedings of IEEE 38th Annual International Computer, Software and Applications Conference (2014)

    Google Scholar 

Download references

Author information

Authors and Affiliations

  1. North China Institute of Computing Technology, Beijing, China

    Wei Yin, Hongjian Zhou & Chunlei Yang

Authors
  1. Wei Yin
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Hongjian Zhou
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Chunlei Yang
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Wei Yin .

Editor information

Editors and Affiliations

  1. Northwestern Polytechnical University, Xi’an, China

    Bo Li

  2. Guangdong Pharmaceutical University, Guangzhou, China

    Lei Shu

  3. China University of Geosciences, Wuhan, Hubei, China

    Deze Zeng

Rights and permissions

Reprints and permissions

Copyright information

© 2018 ICST Institute for Computer Sciences, Social Informatics and Telecommunications Engineering

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Yin, W., Zhou, H., Yang, C. (2018). A Honeyfarm Data Control Mechanism and Forensic Study. In: Li, B., Shu, L., Zeng, D. (eds) Communications and Networking. ChinaCom 2017. Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering, vol 237. Springer, Cham. https://doi.org/10.1007/978-3-319-78139-6_37

Download citation

  • DOI: https://doi.org/10.1007/978-3-319-78139-6_37

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-319-78138-9

  • Online ISBN: 978-3-319-78139-6

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation