A New Approach to Enforce the Security Properties of a Clustered High-Interaction Honeypot
Résumé
This paper enlarges previous works of the authors related to the security of a high-interaction honeypot. The challenge is to have a Security Property Language (SPL) for defining the required properties for controlling the activities between processes and resources. That language must authorize the definition of security properties related to confidentiality, integrity and availability. Moreover, that SPL must be able to enforce the security of target Operating Systems. It is an open problem not only regarding the security of Operating Systems but also regarding the security of high-interaction honeypots. That paper shows that existing approaches really fail to manage a large range of security properties. The first reason is that a SPL is really missing to express and enforce a large set of security properties. The second reason is that protection and detection approaches fail to manage a large set of security properties. Our paper proposes PIGA-Protect a new approach to control the system calls in order to guarantee the requested security properties. It goes much further than existing systems, since a language is proposed for expressing a large range of security properties. That language authorizes to enforce security properties that cannot be easily managed with other approaches. Finally, security properties are proposed for a high interaction honeypot. The goal is to capture information about attacks without compromising the system and without restricting too much the attacker activities. In this case, the attacker must get sufficient privileges without corrupting the system. For that purpose, the formalized properties are taken into account by 1) PIGA-Protect to prevent from corruption and by 2) PIGA-IDS to detect malicious activities and to ease the attack analysis.