ScriptGen: an automated script generation tool for honeyd

Abstract

Honeyd [14] is a popular tool developed by Niels Provos that offers a simple way to emulate services offered by several machines on a single PC. It is a so called low interaction honeypot. Responses to incoming requests are generated thanks to ad-hoc scripts that need to be written by hand. As a result, few scripts exist, especially for services handling proprietary protocols. In this paper, we propose a method to alleviate these problems by automatically generating new scripts. We explain the method and describe its limitations. We analyze the quality of the generated scripts thanks to two different methods. On the one hand, we have launched known attacks against a machine running our scripts; on the other hand, we have deployed that machine on the Internet, next to a high interaction honeypot during two months. For those attackers that have targeted both machines, we can verify if our scripts have, or not, been able to fool them. We also discuss the various tuning parameters of the algorithm that can be set to either increase the quality of the script or, at the contrary, to reduce its complexity.

Hidden Markov Models for Automated Protocol Learning

“…Current approaches to protocol inference can be divided into two primary groups: those that infer partial or complete protocol formats [5,6,7,8,9,10], and those that infer a state machine model [11,12]. Both groups can be further divided into those that examine network traces [5,11,6,7], and those that additionally examine how a protocol implementation processes those traces [8,9,10,12].…”

“…Both groups can be further divided into those that examine network traces [5,11,6,7], and those that additionally examine how a protocol implementation processes those traces [8,9,10,12]. Each approach has different strengths and weaknesses, but both must identify the location and size of protocol headers.…”

SGNET: A Worldwide Deployable Framework to Support the Analysis of Malware Threat Models

“…SGNET obtains the aforementioned objective exploiting the strengths of the ScriptGen technology [22,21] and dynamically combining them with other existing solutions, namely Argos [25] and Nepenthes [4]. However, SGNET is more than a simple deployment of existing tools.…”

“…The ScriptGen learning takes as input a set of samples of network interaction between a client and the real implementation of a server. The core of the learning phase is the Region Analysis algorithm introduced in [22]: taking advantage of bioinformatics alignment algorithms [23], the algorithm exploits the statistical variability of the samples to identify portions of the protocol stream likely to carry a strong semantic meaning and discard the others. This enables us to rebuild a semantic abstraction as shown in Figure 1 for an excerpt of SMTP FSM.…”

“…The ScriptGen technology [22,21] was created with the purpose of generating high-depth honeypots having a limited resource consumption. This is possible by learning the behavior of a given network protocol and represent this behavior under the form of a Finite State Machine.…”