Alata, E.

Leita, C.

Serafini, M.

Stankovic, V.

Thonnard, O.

Viniikka, J.

Zurutuza, U.

English

City Research Online

Stankovic, V., Alata, E., Leita, C., Serafini, M., Thonnard, O., Viniikka, J. & Zurutuza, U. (2008). Malicious Fault Characterization Exploiting Honeypot Data. Paper presented at the 7th European Dependable Computing Conference (EDCC 2008), 7 - 9 May 2008, Kaunas, Lithuania.City Research OnlineOriginal citation: Stankovic, V., Alata, E., Leita, C., Serafini, M., Thonnard, O., Viniikka, J. & Zurutuza, U. (2008). Malicious Fault Characterization Exploiting Honeypot Data. Paper presented at the 7th European Dependable Computing Conference (EDCC 2008), 7 - 9 May 2008, Kaunas, Lithuania.Permanent City Research Online URL: http://openaccess.city.ac.uk/527/ Copyright & reuseCity  University  London has developed City  Research Online  so that  its  users  may access the research outputs of City University London's staff. Copyright © and Moral Rights for this paper are retained by the individual author(s) and/ or other copyright holders. Users may download and/ or print one  copy  of  any  article(s)  in  City  Research  Online  to  facilitate  their  private  study  or  for  non-commercial research. Users may not engage in further distribution of the material or use it for any profit-making activities or any commercial gain. All material in City Research Online is checked for eligibility for copyright before being made available in the live archive. URLs from City Research Online may be freely distributed and linked to from other web pages. Versions of researchThe version in City Research Online may differ from the final published version. Users are advised to check the Permanent City Research Online URL above for the status of the paper.EnquiriesIf you have any enquiries about any aspect of City Research Online, or if you wish to make contact  with the author(s) of this paper, please email the team at publications@city.ac.uk.Malicious fault characterization exploiting honeypot dataCorrado Leita, Olivier ThonnardInstitut EurecomFranceleita@eurecom.fr,olivier.thonnard@rma.ac.beEric AlataLAASFranceealata@laas.frMarco SerafiniTU DarmstadtGermanymarco@deeds.informatik.tu-darmstadt.deVladimir StankovicCity University LondonUnited Kingdomek274@soi.city.ac.ukJouni ViinikkaFrance Telecom R&DFrancejouni.viinikka@orange-ftgroup.comUrko ZurutuzaMondragon UniversitySpainuzurutuza@eps.mondragon.edu1 IntroductionReSIST is a NoE that addresses the strategic objective“Towards a global dependability and security framework”of the European Union Work Programme, and responds tothe stated “need for resilience, self-healing, dynamic con-tent and volatile environments”. In the context of the ResistNetwork of Excellence, funds were allocated to one-yearsub-projects addressing some of the “dependability and se-curity gaps” identified by the network activity. We intro-duce here the outcomes and deliverables expected by one ofthese sub-projects, named “Honeypots”, started in January2008 and with expected completion at the end of 2008.In order to assess the resilience of a system it is impor-tant to take into consideration malicious faults. In the spe-cific case of a computer system, one of the most importantclasses of malicious faults is linked to Internet attacks. Thegap GA2 in [13] shows how the lack of unbiased, represen-tative and useful data poses a serious limitation to any at-tempt of quantifying and characterizing the security threatsto which a computer system may be exposed. Despite theconsiderable number of ongoing projects [17, 3, 4, 1, 6]aiming at collecting data about Internet malicious activities,the lack of “good” data with respect to this objective is animportant gap of the current state of the art. Also, there is alack of rigorous methodologies and models that can be usedto extract relevant information and trends from the collecteddata.In this project we want to address an interesting sub-problem of this gap: classify and characterize real-world In-ternet attacks linked to the spread of self-propagating mal-ware. While the scenario of Internet attacks in the past wascharacterized by a few but extremely visible phenomenalinked to the spread of worms, nowadays’ scenario is farmore complex. The objectives of the hackers have changed,and what started as a competition to gain visibility by in-fecting large populations of machines in very short timehas now become a more organized covert activity aimingat economical profit. Internet is now dominated by a largenumber of different classes of malware aiming at silentlytaking control of computer systems in order to steal bank-ing accounts, generate spam, steal credit card numbers, andmany other profit-oriented operations. Even if the presenceof these different classes is of public knowledge, we lackquantitative information on their spread, on their impact, ontheir evolution. This project aims at investigating the fea-sibility of using real data provided by honeypots to obtainsuch information.2 Project activityWe plan to collect data taking advantage of a distributedhoneypot deployment, developed at Institut Eurecom, calledSGNET [8, 9]. SGNET aims at deploying small sensors indifferent locations of the IP space. These sensors emulatenetwork services and, taking advantage of the ScriptGentechnology [10, 11], achieve a very high level of verbosity at33a very low cost. With respect to existing honeypot deploy-ments, SGNET allows to achieve an extremely rich amountof information about the network activities hitting the hon-eypot, with special focus on code injection attacks. SGNETis in fact able to emulate the whole attack trace, understand-ing the presence of a successful code injection, and emulat-ing its behavior ultimately downloading samples of the mal-ware. This process allows to retrieve extremely valuable in-formation about the intention of the attacker and its nature.This information is stored in a relational database for fur-ther analysis and constitutes the foundation over which weare planning to work within this project.The “Honeypots” project aims at exploiting the informa-tion collected by the SGNET deployment. The project ac-tivity will follow two main lines of operation. Firstly, wewill enrich the collected data through the comparison withother information sources. Secondly, we will dig into thecollected data and try to abstract meaningful informationtaking advantage of existing algorithms developed by theparticipants in different contexts.2.1 Correlation with other informationsourcesSome of the participants to the project manage differenthoneypot deployments taking advantage of different tech-nologies. These technologies range from Honeynet Al-liance deployments [1] to other high interaction techniques[2]. The reasons underneath the comparison of the informa-tion collected by different techniques are twofold. On theone hand, the diversity in collection techniques may allowto detect “blindness” of one approach to security events ob-served by the other approach. On the other hand, combiningdiverse information retrieved using different approaches po-tentially allows to enrich and consolidate the global view onthe observed security events.City University has deployed several high-interactionhoneypots, which contain a mixture of Linux and Windowshosts and following the directions of the Honeynet Alliance[1]. These deployments emulate the traffic observed in cor-porate or SME (Small to Medium Business) environments.The network traffic collected in these honeynets will becompared with the SGNET data, e.g. exploratory analysisof the times between attacks on different hosts, operatingsystems, networks or geographical location will be detailed.Mondragon University will proceed on the same line ofCity University, but from a different perspective. Mon-dragon University will provide a very rich dataset collectedby around 10 honeypots of the Basque Honeynet Alliance[12]. This will allow to a very interesting comparison withthe information provided by the SGNET deployment. Thecomparison will focus on different parameters than thoseanalyzed by City University. For instance, both honeypotdeployments being able to download malware using differ-ent strategies, we will compare the trends in malware down-load offered by the two technologies.LAAS University will exploit the previous work on highinteraction honeypots [2] to observe the behavior of attack-ers once they manage to get access to the core of the sys-tem. We plan to use this information to be able to provideanswers to fundamental questions such as “what attackersdo in the core of the system?” And “what are their objec-tives?”. The goal is to better understand the motivationsand methods of attackers. One way to achieve this goal is tostudy the sequence of commands performed by the attack-ers, using clustering techniques and symbolic time series.2.2 Data enrichment through analysisThe information retrieved by the honeypot deploymentsis vast. In order to build characterizations of the observedsecurity events we need a set of tools and techniques to minethe collected data and extract more meaningful aggregateinformation. We plan to take advantage of existing algo-rithms developed by some of the participants to the projectto achieve this goal. The data mining techniques developedin the context of the Leurre´.com honeypot deployment [5]can be of great help in organizing the collected data. Timeseries analysis developed in the context of IDS alert analy-sis [16] and statistical modelling [7] can help us in digginginto the data filtering out uninteresting activities.The data mining algorithms developed at Eurecom havebeen used so far to discover similarity patterns between theattacks over extended periods of time (e.g. several monthsor years). This long term analysis has already delivered in-teresting results about certain classes of malicious activitiesthat seem to be correlated over long periods of time. In or-der to better address the highly dynamic and changing be-havior new emerging threats, and also to understand how thethreats evolve over time, we need to effectively identify therelevant periods of attack activities (i.e. the “attack events”)on our sensors prior the execution of any correlative analy-sis. France Telecom R&D will provide its expertise in timeseries analysis [15, 14] to identify attack events within thehoneypot time series. This can increase the quality and thesignificance of the results of the correlation algorithms de-veloped by Eurecom. The final objective is to combine andautomate both approaches (detection and correlation) so asto facilitate the processing of large quantities of data andto improve the discovery of meaningful information fromhoneypot data.Eurecom will also provide an extension of its correlationframework in order to take advantage of the extensive in-formation provided by SGNET. Such an extension will beused in the second half of the project to conduct an exten-sive analysis, so as to understand and characterize the evo-34lution of malware activities in both the time domain and inthe “spatial” domain (i.e. along the Internet IP space).Attackers can use intruded nodes to disrupt the operationof distributed systems, for example by creating inconsis-tencies in a distributed file system where data is replicatedon multiple machines to guarantee integrity and availability.Since tolerance to intrusions (or in general Byzantine faults)is expensive, it is important to estimate how many faults areto be tolerated. TU Darmstadt will look at the Honeypotdata to answer this question for systems that are subject tountargeted attacks.3 ConclusionsSummarizing, the “Honeypots” project aims at exploringthe feasibility of characterizing Internet attacks by digginginto the information collected by different honeypot deploy-ments. We hope to achieve this through the joint efforts ofresearchers with different competencies and resources. Theultimate goal of the project is providing a significant step to-wards the collection of unbiased, representative and usefuldata on real world attacks.AcknowledgmentThis work is supported by the ReSIST Network of Ex-cellence (contract number 026764).References[1] Know your enemy: GenII honeynets. Know Your EnemyWhitepapers, May 2005.[2] E. Alata, V. Nicomette, M. Kaaˆniche, M. Dacier, andM. Herrb. Lessons learned from the deployment of a high-interaction honeypot. In EDCC’06, 6th European Depend-able Computing Conference, Oct 2006.[3] M. Bailey, E. Cooke, F. Jahanian, J. Nazario, and D. Wat-son. The internet motion sensor: A distributed blackholemonitoring system. In 12th Annual Network and DistributedSystem Security Symposium (NDSS), San Diego, February2005.[4] Caida Project. The UCSD Network Telescope,www.caida.org, 2007.[5] M. Dacier, F. Pouget, and H. Debar. Leurre.com: On theadvantages of deploying a large scale distributed honeypotplatform. In Proceedings of the E-Crime and ComputerConference 2005 (ECCE’05), Monaco, March 2005.[6] DShield. Distributed Intrusion Detection System,www.dshield.org, 2007.[7] M. Kaaˆniche, E. Alata, V. Nicomette, Y. Deswarte, andM. Dacier. Empirical analysis and statistical modelingof attack processes based on honeypots. WEEDS 2006-workshop on empirical evaluation of dependability and se-curity (in conjunction with the international conference ondependable systems and networks,(DSN2006), pages 119–124, 2006.[8] C. Leita and M. Dacier. SGNET: a worldwide deployableframework to support the analysis of malware threat models.In Proceedings of the 7th European Dependable ComputingConference (EDCC 2008), May 2008.[9] C. Leita and M. Dacier. SGNET: Implementation Insights.In IEEE/IFIP Network Operations and Management Sym-posium, April 2008.[10] C. Leita, M. Dacier, and F. Massicotte. Automatic han-dling of protocol dependencies and reaction to 0-day attackswith ScriptGen based honeypots. In RAID 2006, 9th Inter-national Symposium on Recent Advances in Intrusion De-tection, September 20-22, 2006, Hamburg, Germany - Alsopublished as Lecture Notes in Computer Science Volume4219/2006, Sep 2006.[11] C. Leita, K. Mermoud, and M. Dacier. Scriptgen: an au-tomated script generation tool for honeyd. In Proceedingsof the 21st Annual Computer Security Applications Confer-ence, December 2005.[12] Mondragon University. Euskalert, the basque honeynet al-liance. Web page at http://www.euskalert.net,2008.[13] ReSIST NoE. From resilience-building to resilience-scalingtechnologies: Directions. Deliverable D13, 2007.[14] J. Viinikka. Intrusion Detection Alert Flow Processing Us-ing Time Series Analysis Methods. PhD thesis, University ofCaen, Caen, France, Nov. 2006.[15] J. Viinikka, H. Debar, L. Me´, A. Lehikoinen, and M. Tar-vainen. Processing intrusion detection alert aggregates withtime series modeling. Information Fusion Journal, 2008.Special Issue on Computer Security, to appear.[16] J. Viinikka, H. Debar, L. Me´, and R. Se´guier. Time seriesmodeling for IDS alert management. Proceedings of the2006 ACM Symposium on Information, computer and com-munications security, pages 102–113, 2006.[17] D. Zamboni, J. Riordan, and Y. Duponchel. Building anddeploying billy goat: a worm-detection system. In 18th An-nual FIRST Conference, June 2006.35

Malicious Fault Characterization Exploiting Honeypot Data

Malicious Fault Characterization Exploiting Honeypot Data

Abstract

Similar works

Full text

Available Versions

City Research Online