Construction and detection method of honeypot-prescient semi-distributed Peer-to-Peer Botnet
Zhou Ming-tian · Computer Engineering and Applications Journal · 2011
The honeypot technology plays an important role in detecting and defending botnet.The existing honeypot technologies have a serious vulnerability,that is the defender has the responsibility to prevent honeypot from attacking in configuring.An attacker may make use of the sensor authenticators to build a botnet which can avoid the honeypot.For such botnet,the proposed honeypot-prescient Semi-Distributed P2P botnet has been given.A double-honeypot detection method has been presented,which combines highly interactive honeypot with low-interaction honeypot to detect this botnet,this method has been analysed compared with traditional honeypot technology.The experiment result shows that the detection method can effectively close the vulnerability of honeypot defense technology,and improve the detection rate of honeypot-prescient Semi-Distributed P2P botnet.