Automatic Handling of Protocol Dependencies and Reaction to 0-Day Attacks with ScriptGen Based Honeypots

Abstract

Abstract. Spitzner proposed to classify honeypots into low, medium and high interaction ones. Several instances of low interaction exist, such as honeyd, as well as high interaction, such as GenII. Medium interaction systems have recently received increased attention. ScriptGen and RolePlayer, for instance, are as talkative as a high interaction system while limiting the associated risks. In this paper, we do build upon the work we have proposed on ScriptGen to automatically create honeyd scripts able to interact with attack tools without relying on any a-priori knowledge of the protocols involved. The main contributions of this paper are threefold. First, we propose a solution to detect and handle so-called intra-protocol dependencies. Second, we do the same for inter-protocols dependencies. Last but not least, we show how, by modifying our initial refinement analysis, we can, on the fly, generate new scripts as new attacks, i.e. 0-day, show up. As few as 50 samples of attacks, i.e. less than one per platform we have currently deployed in the world, is enough to produce a script that can then automatically enrich all these platforms.

SGNET: A Worldwide Deployable Framework to Support the Analysis of Malware Threat Models

“…Also, this paper presents an important extension of the ScriptGen technology as presented in previous work [21]. We will show in this paper how we have been able to extend the technology, originally conceived to learn and emulate pure network interaction, to embed in the learning phase code injection information.…”

“…SGNET obtains the aforementioned objective exploiting the strengths of the ScriptGen technology [22,21] and dynamically combining them with other existing solutions, namely Argos [25] and Nepenthes [4]. However, SGNET is more than a simple deployment of existing tools.…”

“…SGNET is the first Internet deployment taking advantage of the ScriptGen technology. In [21], the technology was validated through a set of experiments conducted in a lab. In a way, the experiments artificially created the required conditions for the ScriptGen technology to work correctly.…”

“…The ScriptGen technology [22,21] was created with the purpose of generating high-depth honeypots having a limited resource consumption. This is possible by learning the behavior of a given network protocol and represent this behavior under the form of a Finite State Machine.…”

“…The properties of the ScriptGen approach allow to perform a completely automated incremental learning of the activities as shown in [21]. ScriptGen-based honeypots are able to detect when a client request falls out of the current FSM knowledge (0-day attack) by simply detecting the absence of a matching transition.…”