Advertising Honeypots. A honeypot is a decoy system placed in the network to detect and analyse attacker behaviours. A honeypot is useful for network security if it is able to get the attention of the attackers. To successfully analyse the manipulation of traffic using honeypots the following questions need to be considered: Where in the network should the honeypot be deployed? Which operating systems would be most useful for the honeypot to imitate to optimise the detection and analysis of attacks? Which methods do intruders use? Intruder profiles depend on the position of the honeypot in the network: A honeypot deployed on a Local Area Network (LAN) will be targeted by internal intruders. An example of this is an employee searching the LAN for vulnerable machines. A honeypot deployed on a demilitarised zone (DMZ) can imitate the web server of the company. In this case the honeypot will be targeted by attackers outside and inside the company. Honeypots may be classified based on whether they are deployed in a production or research network. Production honeypots are low interaction honeypots that are easier to deploy and less risky for the network. They provide less information about the attacks and the attackers than research honeypots do. Research honeypots are used to research the threats that organisations face. They are complex to deploy and maintain, however, they capture detailed information about the threats. Honeypots imitate valuable sources (such as databases, credentials, services etc.) to attract intruders. Selecting which sources a honeypot contains affects how much traffic it attracts. More popular services, such as SMTP or Hypertext Transfer Protocol (HTTP), receive more traffic than File Transfer Protocol (FTP). Deploying systems that have known vulnerabilities attracts more attackers. Honeypots also need to successfully imitate data sources to be attractive to attackers. The names chosen for hosts, databases and services should be interesting to attackers. For example, a honeypot imitating a mail server may have the host name ―NREN_mailserver‖. The level of interaction (high, medium, low) determines the length of an intruder’s stay. Determining the level of interaction is a balancing act. If the level of interaction is high, the honeypot is more likely to be compromised. It is also important to understand the path attackers follow when they find a vulnerable target. The main attack method used in an IPv4 network is scanning the address space for vulnerable targ...
