Search results for "Honeypot"
showing 5 items of 5 documents
Honeypot utilization for analyzing cyber attacks
2016
Honeypot systems are an effective method for defending production systems from security breaches and to gain detailed information about attackers' motivation, tactics, software and infrastructure. In this paper we present how different types of honeypots can be employed to gain valuable information about attacks and attackers, and also outline new and innovative possibilities for future research.
Virtual USB honeypot
2019
This paper presents the implementation of a malware trap device. We created a virtual usb device through the use of microvisor on the ARM platform.
Honeypot Utilization for Network Intrusion Detection
2018
For research purposes, a honeypot is a system that enables observing attacker’s actions in different phases of a cyberattack. In this study, a honeypot called Kippo was used to identify attack behavior in Finland. The gathered data consisted of dictionary attack login attempts, attacker location, and actions after successful login. From the data, attacker behavior was analyzed. Differentiating bots from human actors, linking scanning activity to further attack steps, and identifying malware and tracking malware sites were all done. The knowledge gained could be used to enhance an organization’s cyber resiliency by identifying attacker motivations and the tools used. Automating analysis of h…
They are looking at me! Understanding how Audience Presence Impacts on Public Display Users
2017
It is well known from prior work, that people interacting as well as attending to a public display attract further people to interact. This behavior is commonly referred to as the honeypot effect. At the same time, there are often situations where an audience is present in the vicinity of a public display that does not actively engage or pay attention to the display or an approaching user. However, it is largely unknown how such a \textit{passive audience} impacts on users or people who intend to interact. In this paper, we investigate the influence of a passive audience on the engagement of people with a public display. In more detail, we report on the deployment of a display in a public s…
Hypervisor Memory Introspection and Hypervisor Based Malware Honeypot
2020
Memory acquisition is a tool used in advanced forensics and malware analysis. Various methods of memory acquisition exist. Such solutions are ranging from tools based on dedicated hardware to software-only solutions. We proposed a hypervisor based memory acquisition tool. [22]. Our method supports ASLR and Modern operating systems which is an innovation compared to past methods [27, 36]. We extend the hypervisor assisted memory acquisition by adding mass storage device honeypots for the malware to cross and propose hiding the hypervisor using bluepill technology.