Deploying Honeypots Sample Clauses

Deploying Honeypots. Honeypots have proven their importance in capturing malware including Internet worms and are very valuable in keeping track of global malicious activity on the Internet. In the context of the GÉANT project they are planned to complement network-based monitoring components to facilitate a precise analysis of global anomalies that are, for example, caused by Internet worms. Two classes of honeypots have evolved from the different aims of honeypot deployment: Low-interaction honeypots Low-interaction honeypots are systems that emulate vulnerable services or backdoors. Their purpose is to collect as much statistical data as possible about known attacks and compromised hosts. This includes the capture of malware that is related to the attacks. These honeypots typically pose as finite state machines that emulates the behaviour of a vulnerable service. Each state corresponds to a specific step of the attack. Thus, for each attack a corresponding state machine has to be designed. However, the finite state machines require significantly less resources than the corresponding operational service or program. This efficiency allows a single physical machine to monitor a large network space. A drawback of low-interaction honeypots is the roughness of the simulation. A more accurate simulation would computationally be too expensive in comparison to the corresponding operational service. For that reason, most unknown attacks fail to interact with the simulated service before the vulnerability itself is triggered. To alleviate this, Dionaea implement significant parts of the Windows Server Message Block (SMB) protocol and Remote Procedure Call (RPC) services. However, this implementation is very expensive and can only cover fractions of the Windows functionality. High-interaction honeypots The limitations of low-interaction honeypots can be completely overcome by using a productive operating system as a honeypot (a high-interaction honeypot). This is highly advantageous for spotting new attacks and zero-day exploits, because all unknown network traffic and binary execution can be monitored However, since high-interaction honeypots deploy productive services they can be compromised like other insecure systems and pose a security threat to the Internet. In addition, attacker who compromised the honeypot must be prevented from being able to manipulate or create forged data. High-interaction honeypots also require much more resource than low-interaction honeypot which limits t...