Comparative survey of local honeypot sensors to assist network forensics

P. T. Chen, C. S. Laih, F. Pouget, M. Dacier

Research output: Chapter in Book/Report/Conference proceedingConference contribution

11 Citations (Scopus)

Abstract

This paper intends to illustrate the usefulness of deploying multiple simple honeypot sensors in a large variety of locations. Indeed, a permanent identification of anomalies that occur on a single sensor allows pinpointing abnormal local activities. These can be the manifest of misconfiguration issues or highlight attacks particular to some given environments. Both cases are important for administrators in charge of the networks hosting the sensors. We propose in this paper a comparison of simple parameters that reveal to be an easy way to determine these abnormal and particular activities. On the basis of two identical honeypot sensors that we have deployed for more than 6 months in France and in Taiwan, we detail the analysis of some anomalies that have been found against one unique sensor only. This is a preliminary but useful stage for network forensics and we intend in a near future to deploy the method over a large number of sensors. This is an on-going work and we hope that the illustrations we provide all along the paper will be a good incentive for partners to join this open project.

Original languageEnglish
Title of host publicationProceedings - First International Workshop on Systematic Approaches to Digital Forensic Engineering
Pages120-132
Number of pages13
DOIs
Publication statusPublished - 1 Dec 2005
EventProceedings - First International Workshop on Systematic Approaches to Digital Forensic Engineering - Taipei, Taiwan, Province of China
Duration: 7 Nov 20059 Nov 2005

Publication series

NameProceedings - First International Workshop on Systematic Approaches to Digital Forensic Engineering
Volume2005

Conference

ConferenceProceedings - First International Workshop on Systematic Approaches to Digital Forensic Engineering
CountryTaiwan, Province of China
CityTaipei
Period7/11/059/11/05

ASJC Scopus subject areas

  • Engineering(all)

Fingerprint Dive into the research topics of 'Comparative survey of local honeypot sensors to assist network forensics'. Together they form a unique fingerprint.

  • Cite this

    Chen, P. T., Laih, C. S., Pouget, F., & Dacier, M. (2005). Comparative survey of local honeypot sensors to assist network forensics. In Proceedings - First International Workshop on Systematic Approaches to Digital Forensic Engineering (pp. 120-132). [1592526] (Proceedings - First International Workshop on Systematic Approaches to Digital Forensic Engineering; Vol. 2005). https://doi.org/10.1109/SADFE.2005.6