Honey@home A New Approach to Large-Scale Threat Monitoring.pdfVIP

Honey@home: A New Approach to Large-Scale Threat Monitoring S. Antonatos, E. P. Markatos Institute of Computer Science Foundation for Research and Technology, Hellas PO Box 1385, Heraklion, Crete, Greece {antonat,markatos}@ics.forth.gr K. G. Anagnostakis Cryptography and Security Department Institute for Infocomm Research 21 Heng Mui Keng Terrace, Singapore kostas@.sg ABSTRACT Honeypots have been shown to be very useful for accurately detecting attacks, including zero-day threats, at a reason- able cost and without false positives. However, there are two pressing problems with existing approaches. The first problem is that timely detection requires deployment of hon- eypots in a large fraction of the network address space, many organizations cannot afford. The second problem is that at- tackers are evolving, and it has been shown that it is not difficult for them to identify honeypots and develop black- lists to avoid them when launching an attack. In response to these problems, we propose a new architec- ture that enables large-scale deployment at low cost, while making it harder for attackers to maintain accurate black- lists. The Honey@home architecture relies on communities of regular users installing a lightweight honeypot that moni- tors unused addresses and ports. Because it does not require the static allocation of valuable chunks of network address space, and considering the success of other community-based approaches such as seti@home, our approach is well-suited for creating a large-scale honeypot infrastructure at low cost. Since participation in the system is dynamic as users come and go, it becomes harder for attackers to maintain accurate blacklists. In this paper we discuss the current design of the Honey@home architecture, a preliminary implementation and describe the design issues that we faced especially with respect to infras- tructure robustness, the challenges we have to deal with and the effectiveness of our approach. Categories and Subject De