To Catch A Predator: A Natural Language Approach for Eliciting Malicious Payloads
Sam J. Small, Niels Provos, Google Inc, Joshua Mason, Adam Stubblefield, Fabian Monrose · 2008
We present an automated, scalable method for craft-ing dynamic responses to real-time network requests. Specifically, we provide a flexible technique based on natural language processing and string alignment tech-niques for intelligently interacting with protocols trained directly from raw network traffic. We demonstrate the utility of our approach by creating a low-interaction web-based honeypot capable of luring attacks from search worms targeting hundreds of different web applications. In just over two months, we witnessed over 368, 000 attacks from more than 5, 600 botnets targeting several hundred distinct webapps. The observed attacks included several exploits detected the same day the vulnerabilities were publicly disclosed. Our analysis of the payloads of these attacks reveals the state of the art in search-worm based botnets, packed with surprisingly modular and di-verse functionality. 1