Enhancing network intrusion detection system with honeypot
S. Yeldi, Swati Gupta, T. Ganacharya, Sheetalkumar Doshi, D. Bahirat · 2004
Traditionally, the strategy to defend one's organization as best as possible is to detect any failures in the defense, and then react to those failures. The problem with this approach is that it is purely defensive; the enemy is on the attack. Honeypots attempt to change this; they give the organizations the ability to take the initiative. Honeypots help to explore new vulnerabilities in an organization and defining the security policy of an organization. A honeypot is used in the area of computer and Internet security. It is a resource, which is intended to be attacked or compromised to gain more information about the attacker and his attack techniques. It can also be used to attract and divert an attacker from the real targets. This paper focuses on the possibilities of honeypots and their use in an educational as well as productive environment. Also 'Mirage' - honeypot developed by us has been discussed. This system was not only implemented but also tested for several days and the collected data of the attacks was analyzed. A conclusion about the new technology of honeypots and a look into the future of honeypots is discussed.