ScriptGen: an automated script generation tool for Honeyd

Honeyd (N. Provos, 2004) is a popular tool developed by Niels Provos that offers a simple way to emulate services offered by several machines on a single PC. It is a so called low interaction honeypot. Responses to incoming requests are generated thanks to ad hoc scripts that need to be written by h...

Full description

Saved in:
Bibliographic Details
Published in21st Annual Computer Security Applications Conference (ACSAC'05) pp. 12 pp. - 214
Main Authors Leita, C., Mermoud, K., Dacier, M.
Format Conference Proceeding
LanguageEnglish
Published IEEE 2005
Subjects
Application software
Automata
Computer security
Documentation
Fingerprint recognition
Internet
Protocols
Web server
Writing
Online AccessGet full text

Cover

More Information
Summary:Honeyd (N. Provos, 2004) is a popular tool developed by Niels Provos that offers a simple way to emulate services offered by several machines on a single PC. It is a so called low interaction honeypot. Responses to incoming requests are generated thanks to ad hoc scripts that need to be written by hand. As a result, few scripts exist, especially for services handling proprietary protocols. In this paper, we propose a method to alleviate these problems by automatically generating new scripts. We explain the method and describe its limitations. We analyze the quality of the generated scripts thanks to two different methods. On the one hand, we have launched known attacks against a machine running our scripts; on the other hand, we have deployed that machine on the Internet, next to a high interaction honeypot during two months. For those attackers that have targeted both machines, we can verify if our scripts have, or not, been able to fool them. We also discuss the various tuning parameters of the algorithm that can be set to either increase the quality of the script or, at the contrary, to reduce its complexity
ISBN:9780769524610
0769524613
ISSN:1063-9527
2576-9103
DOI:10.1109/CSAC.2005.49