A distributed plateform of high interaction honeypots and experimental results (extended version)

Ivan Studnia (1) , Vincent Nicomette (1) , Mohamed Kaâniche (1) , Eric Alata (2)

1 LAAS-TSF - Équipe Tolérance aux fautes et Sûreté de Fonctionnement informatique
2 LAAS - Laboratoire d'analyse et d'architecture des systèmes

The increase of various malicious activities spreading on the Internet network are today a crucial problem. In order to understand the motivations and operating modes of the attackers, it is necessary to collect data characterizing these malicious activities. Their analysis enables to better face these attacks, anticipate new threats and better adpat the corresponding protection mechanisms. This paper proposes a distributed platform oh high interaction honeypots deployed for that purpose. The paper describes 1) the design and implementation of this platform, 2) the methodology used to collect and record data characterizing the malicious activities and 3) the first analyses carried out on this data.

Mots clés: Security; Experimental Evaluation; honeypots; experiments

Domaines: Cryptographie et sécurité [cs.CR]

Ivan Studnia, Vincent Nicomette, Mohamed Kaâniche, Eric Alata. A distributed plateform of high interaction honeypots and experimental results (extended version). Privacy Security Trust (PST 2012), Jul 2012, Paris, France. 8p. ⟨hal-00706333⟩