A Cloud-Native Honeynet Automation and Orchestration Framework
Akash Ravi, Bhavye Sharma, Avigyan Mukherjee · 2023
This research utilizes containerization techniques to dynamically build honeynets which provide a deceptive environment to the attacker and proposes a framework for its usage in existing cloud infrastructure. We aim to contribute to the existing literature on the creation of cost-effective dynamic honeynets. The proposed architecture can temporarily spin up honeypot services as it detects the attacker and log everything the attacker does for post-incident or experimental research. We use simulation of attacker isolation on cloud-native systems using docker, and integrate a virtual honeypot OS (Cowrie) to record logs, following which threat modeling on the proposed architecture has been used to qualitatively analyze and propose a general framework for its implementation. Potential benefits of the proposed framework include risk mitigation, cost-effectiveness in terms of memory and process, vendor agnostic, and finally, it also addresses moving target defenses i.e, continuously shifting the configuration of the underlying system making it harder to comprehend the honeynet implementation.