Other Honeypot Applications

Ng, C. K.; Pan, Lei; Xiang, Yang

doi:10.1007/978-981-10-7739-5_5

Cited by 2 publications

(2 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A honeypot may be a software, hardware unit, or a combination of both, which attracts the attacker and intentionally lures the attacker to launch an attack against the system. Types of honeypots include pure honeypots, high interaction honeypots, low interaction honeypots [19] [20] [21], Honeywall [22], Honeytokens [23], Honeynets [24], and Honeyfarms [25].…”

Section: A Conventional Solutionsmentioning

confidence: 99%

PREVIR: Fortifying Vehicular Networks Against Denial of Service Attacks

Verma,

Saha,

Kumar

et al. 2024

IEEE Access

View full text Add to dashboard Cite

Vehicular networks are expanding their applications for future sustainability. The reported increasing rate of data breaches through vehicular networks by Distributed Denial of Service (DDoS) type of intrusion creates concern for such networks. Existing security solutions focus only on intrusion detection. However, prevention solutions are more proactive and provide security by probabilistic analysis. Existing prevention models for vehicular networks have low accuracy and are unable to handle zero-day attacks and advanced persistent threats. In this paper, we solve the problems mentioned above and introduce Predictive Risk Evaluation for Vehicular Infrastructure Resilience (PREVIR), the first amalgamated model of logit method (statistical analysis) and LogitBoost method (machine learning) to prevent DDoS attacks in vehicular networks. In PREVIR, the logit model predicts the packet probabilities for identifying maliciousness. The machine learning method improves PREVIR's performance through iterative refinement of the model's periodic updates based on new traffic parameters. We run a set of experiments on PREVIR. We use our NS3-generated dataset, NSL-KDD public dataset, and CIC-DDoS public dataset. PREVIR analyses multiple attack types, including UDP flood, TCP flood, mixed flooding, U2R, Probe, and R2L attacks. The results show that PREVIR classifies packets with accuracy up to 99.99%. Our proposed PREVIR model achieves a True Positive Ratio (TPR) up to 100% and an average False Positive Ratio (FPR) of 35%. The comparative analysis shows that PREVIR's efficiency is 20% better on average in the prevention of malicious packets as compared to the state-of-the-art models.

show abstract

Section: A Conventional Solutionsmentioning

confidence: 99%

PREVIR: Fortifying Vehicular Networks Against Denial of Service Attacks

Verma,

Saha,

Kumar

et al. 2024

IEEE Access

View full text Add to dashboard Cite

show abstract

“…However, these purposes can be achieved only if it can operate without being identified as a trap by adversaries; otherwise, its values are significantly reduced or completely diminished. Honeypots can be classified by their degree of interaction that they provide to the attackers: low, medium and high-interaction honeypots [3][4][5].…”

Section: Introductionmentioning

confidence: 99%

A Comparison of an Adaptive Self-Guarded Honeypot with Conventional Honeypots

Touch

Colin

2022

Applied Sciences

View full text Add to dashboard Cite

To proactively defend computer systems against cyber-attacks, a honeypot system—purposely designed to be prone to attacks—is commonly used to detect attacks, discover new vulnerabilities, exploits or malware before they actually do real damage to real systems. Its usefulness lies in being able to operate without being identified as a trap by adversaries; otherwise, its values are significantly reduced. A honeypot is commonly classified by the degree of interactions that they provide to the attacker: low, medium and high-interaction honeypots. However, these systems have some shortcomings of their own. First, the low and medium-interaction honeypots can be easily detected due to their limited and simulated functions of a system. Second, the usage of real systems in high-interaction honeypots has a high risk of security being compromised due to its unlimited functions. To address these problems, we developed Asgard an adaptive self-guarded honeypot, which leverages reinforcement learning to learn and record attacker’s tools and behaviour while protecting itself from being deeply compromised. In this paper, we compare Asgard and its variant Midgard with two conventional SSH honeypots: Cowrie and a real Linux system. The goal of the paper is (1) to demonstrate the effectiveness of the adaptive honeypot that can learn to compromise between collecting attack data and keeping the honeypot safe, and (2) the benefit of coupling of the environment state and the action in reinforcement learning to define the reward function to effectively learn its objectives. The experimental results show that Asgard could collect higher-quality attacker data compared to Cowrie while evading the detection and could also protect the system for as long as it can through blocking or substituting the malicious programs and some other commands, which is the major problem of the high-interaction honeypot.

show abstract

Other Honeypot Applications

Cited by 2 publications

References 13 publications

PREVIR: Fortifying Vehicular Networks Against Denial of Service Attacks

PREVIR: Fortifying Vehicular Networks Against Denial of Service Attacks

A Comparison of an Adaptive Self-Guarded Honeypot with Conventional Honeypots

Contact Info

Product

Resources

About