Publications

Abstract : This paper describes Honeynet, a system for automated generation of attack signatures for network intrusion detection and prevention systems. A honeypot is a security resource whose value lies in being probed, attacked or compromised. We examine different kinds of honeypots, honeypot concepts, and approaches to their implementation. Our system applies pattern detection techniques and protocol based classification on the traffic captured on a honeypot system. Softwares like Sun virtual box-VMware were used for this purpose so that it was not required to buy large number of high end systems for implementing this setup and thereby cost was reduced in a great extend. While running Honeynet on a WAN environment, the system successfully created precise traffic signatures and updates the firewall that otherwise would have required the skills and time of a security officer.