Shedding Light on the Configuration of Dark Addresses.
Sushant Sinha, Michael Q. Bailey, Farnam Jahanian · 2007
A popular approach to detecting and characterizing threats such as worms and botnets involves the use of sacrificial host collections called honeynets. These collections are explicitly deployed to be scanned, compromised, and used in attacks. Unfortunately, existing approaches to deploying honeynets largely ignore the problem of configuring operating systems and applications on individual hosts, leaving the user to configure them in a manual and often ad hoc fashion. In this paper, we demonstrate that such ad hoc configurations are inadequate–they misrepresent the security landscape of the networks they are trying to protect and are relatively easy for attackers to discover. We show that manually building configurations with good visibility and resistance to discovery is hard, as each network has its own unique threat and vulnerability spaces, and the potential number of hosts to configure in the honeynet is quite large. Therefore, we need automated systems to assist network and security administrators in building honeynet configurations. We argue that honeynets with individually consistent hosts and proportional representation of the network will achieve the two desired goals of visibility into network attacks and resistance to discovery. We develop an automated technique based on profiling the network and random sampling to generate these honeynet configurations. Through experimental evaluation and deployment of configurations generated by our technique, we demonstrate significantly more visibility and higher resistance to discovery than current methods. 1