Monitoring and Analyzing Internet Services Using Honeypots (MANPOT)

Abstract

The honeypot has emerged as an effective tool to provide insights into new attacks and current exploitation trends. Though effective, a single honeypot or multiple independently operated honeypots only provide a limited local view of network attacks. Deploying and managing a large number of coordinating honeypots in different network domains will not only provide a broader and more diverse view, but also create potentials in global network status inference, early network anomaly detection, and attack correlation in large scale. However, coordinated honeypot deployment and operation require close and consistent collaboration across participating network domains, in order to mitigate potential security risks associated with each honeypot and the non-uniform level of security expertise in different network domains. It is challenging, yet desirable, to provide the two conflicting features of decentralized presence and uniform management in honeypot deployment and operation. To address these challenges, this project presents Manpot, a virtual-machine-based software tool for network attack detention. A Manpot server manages a large number of high-interaction virtual honeypots in a local dedicated network. These honeypots appear, to potential intruders, as typical systems in their respective production networks. The centralized operations enable dedicated administration and convenient event correlation in the form of logs, eliminating the need for honeypot experts in each production network domain. We present the design, implementation, and evaluation of a Manpot.