Internati
o
nal
Journal of Ele
c
trical
and Computer
Engineering
(IJE
CE)
Vol.
4, No. 6, Decem
ber
2014, pp. 848~
857
I
S
SN
: 208
8-8
7
0
8
8
48
Jo
urn
a
l
h
o
me
pa
ge
: h
ttp
://iaesjo
u
r
na
l.com/
o
n
lin
e/ind
e
x.ph
p
/
IJECE
A New Procedure to Detect
Low In
teracti
on Honeypots
Eleaz
a
r Aguir
re-Anaya
1
, Gi
na
Gallegos
-
G
a
rcia
2
, N
i
co
lá
s S
o
la
no
Lu
na
3
,
Luis Alfo
nso
Villa
Va
rg
as
4
1, 4
Center
for R
e
s
earch
in Com
p
u
ting
2, 3
Department of
Resear
ch
and G
r
aduate Studies,
Electrical and
M
echan
ical Engin
eering
School
Instituto Pol
ité
c
n
ico Na
cion
al,
Mexico C
i
t
y
,
M
e
xico
Article Info
A
B
STRAC
T
Article histo
r
y:
Received Sep 21, 2014
Rev
i
sed
No
v
14
, 20
14
Accepted Nov 22, 2014
Honey
pots s
y
stems are an important
piece of the network security
infras
t
ruc
t
ure
an
d can b
e
dep
l
o
y
ed to
accom
p
lis
h differ
e
nt purp
o
s
e
s
s
u
ch as
:
network sensing
,
capturing
and learni
ng
about 0-
day
explo
its,
capturing an
d
analy
z
ing of black hat techniqu
es, deterr
ing black hats and data gather
ing for
doing statistical analy
s
is over the Intern
et traffic, among others.
Nevertheless, all honey
p
o
t
s need to l
ook like real s
y
stems, due to if a
honey
p
o
t
is unm
asked,
it
loses its
value.
This pap
e
r presen
ts a n
e
w procedure
to detect low interaction honey
pots,
through
HTTP request, regardless
honey
p
o
t
ar
chitectur
e. I
t
is important
to mention
that
Lo
w Interactio
n
Honey
pots network services need to be
improved in order to get trustworth
y
information. Otherwise,
it should consider data
obt
ain
e
d b
y
low
interaction
hone
y
p
o
t
s l
i
ke
i
n
accur
a
t
e
and
un
reli
able
inform
at
ion.
Keyword:
Fi
nge
r
p
ri
nt
Honeypot Syst
e
m
s
Low in
teracti
on
Re
m
o
te Network System
s
Si
gnat
u
res
Copyright ©
201
4 Institut
e
o
f
Ad
vanced
Engin
eer
ing and S
c
i
e
nce.
All rights re
se
rve
d
.
Co
rresp
ond
i
ng
Autho
r
:
Gina Galleg
o
s-
Garcia,
Depa
rt
m
e
nt
of
R
e
search
an
d
Gra
d
uat
e
St
u
d
i
e
s,
Electrical an
d
Mech
an
ical Eng
i
n
e
ering
Schoo
l – In
stitu
to
Po
litécn
ico
Naci
o
n
a
l.
Av.
Sta Ana 1000.
Sn. Fco.
Culhuacan.
Coyo
acán. 04430. Mexico City, Mexico.
Em
a
il: g
g
a
lleg
o
s
g@ipn
.
m
x
1.
INTRODUCTION
No
wa
day
s
,
ho
ney
p
o
t
s
sy
st
e
m
s are im
port
a
nt
com
p
o
n
en
t
s
i
n
t
h
e
o
r
ga
ni
zat
i
o
n
’
s
wh
ol
e sec
u
ri
t
y
in
frastru
ct
u
r
e. Th
ey
can
b
e
u
s
ed
to
h
e
l
p
sen
s
e and
m
itig
ate
secu
rity ev
en
ts.
I
n
[1
],
th
e au
th
or
g
i
v
e
s th
e
de fa
cto
de
fi
ni
t
i
on:
'
A
h
oney
p
ot
i
s
a sec
u
ri
t
y
res
o
u
r
ce
w
h
o
s
e val
u
e l
i
e
s
on
bei
n
g p
r
o
b
e
d, at
t
acke
d
and c
o
m
p
rom
i
sed'
. Ho
weve
r,
i
f
a ho
ney
p
o
t
i
s
det
ect
ed, i
t
l
o
ses al
l
i
t
s
val
u
e. I
n
ot
he
r w
o
r
d
s, i
f
h
o
n
e
y
p
o
t
s
w
e
re sus
cept
i
b
l
e
t
o
be
det
ect
ed, t
h
e B
l
ac
k h
a
t
C
o
m
m
uni
ty coul
d p
o
st
a
l
i
s
t
of
kn
o
w
n
h
o
n
ey
p
o
t
s
sy
st
em
s l
e
tti
ng
ot
he
rs
bl
ac
k
hat
s
a
voi
d t
h
ose sy
st
em
s and
foc
u
s
o
n
real
sy
st
em
s.
Ho
ney
p
o
t
sy
st
em
s are used t
o
resea
r
ch
ove
r
m
a
l
w
are pr
op
agat
i
on a
n
d ne
w i
n
t
r
usi
o
n t
echni
que
s use
d
b
y
b
l
ack
h
a
ts. Th
ey can
g
i
ve th
e po
ssib
ility to
d
e
tect and
an
alyze
0
-
d
a
y ex
p
l
o
its
o
r
t
o
ob
tain
i
n
fo
rmatio
n
rel
a
t
e
d t
o
m
a
lware s
u
ch as:
pr
o
p
agat
i
o
n m
e
t
h
o
d
s o
r
eve
n
t
h
ei
r sou
r
ce code
. M
o
re
o
v
er
, a honey
pot
c
oul
d act
like an alarm
syste
m
because
any receive
d connection, from
a
host in
side orga
nizational net
w
ork,
is an
u
n
e
qu
ivo
cal ind
i
catio
n
th
at inform
at
io
n
security
m
ech
an
ism
s
have bee
n
evade
d
or t
h
e
r
e is an inside
r attacker.
Thi
s
i
n
fo
rm
at
ion c
o
ul
d
be
us
ed t
o
desi
g
n
c
ont
e
n
t
i
on m
e
t
hods
agai
nst
m
a
l
w
are, t
o
i
m
prove
net
w
o
r
k s
ecuri
t
y
mech
an
ism
,
to
d
e
fi
n
e
new
secu
rity po
licies or ch
ang
e
so
m
e
o
f
t
h
em
. Add
itio
n
a
lly to
th
at,
th
e m
a
n
a
g
e
rs co
u
l
d
tak
e
b
e
tter IT
d
ecision
s to
search
ab
ou
t secu
rity in
frast
ru
ctu
r
e or to
d
e
p
l
o
y
n
e
w
IT serv
ices for clien
t
s an
d
part
ners
of ea
ch o
r
ga
ni
zat
i
o
n. H
o
weve
r, i
t
i
s
an im
por
t
a
nt
t
a
sk t
o
kee
p
h
oney
pot
sy
st
em
s uni
dent
i
f
i
e
d i
n
or
der
t
o
c
o
l
l
ect
i
n
f
o
rm
at
i
on f
r
o
m
t
h
e net
w
or
k a
n
d
reac
h i
t
s
goal
s
.
No
wa
day
s
, h
o
n
ey
p
o
t
'
s rem
o
t
e
det
ect
i
on i
s
not
a
n
easy
t
a
sk beca
use t
h
e
det
ect
i
on o
f
unc
om
m
on
envi
ro
nm
ent
s
depe
n
d
s o
n
t
h
e
bl
ack hat
’
s ski
l
l
s
. In exam
ple, detecting a
de
crease in the s
p
eed
of t
h
e ret
u
rning
packet
s
ove
r t
h
e net
w
o
r
k
,
a l
i
m
i
t
e
d am
oun
t
of com
m
ands i
n
t
h
e ser
v
i
ce or t
h
e
ope
ra
t
i
ng sy
st
em
,
l
i
m
i
t
e
d
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
SN
:
2
088
-87
08
IJECE Vol. 4, No. 6, D
ecem
ber 2014
:
848 – 857
8
49
am
ount of libraries and
restri
cted acce
ss to m
e
m
o
ry or file system
areas
. Doi
ng this
detection im
plies the
in
teractio
n b
e
t
w
een th
e
b
l
ack h
a
t an
d hon
eyp
o
t
syste
m
fo
r
a wh
ile.
Honeypot syst
e
m
s are able t
o
efficiently em
ula
t
e a
TC
P/
IP st
ac
k a
nd t
h
ey
al
so ca
n
si
m
u
l
a
t
e
bei
n
g
anot
her
Ope
r
at
i
ng Sy
st
em
over t
h
e net
w
or
k.
B
e
si
des, h
one
y
pot
sy
st
em
s are us
ual
l
y
depl
oy
ed be
hi
n
d
a
NAT
capable
device
and
only the servi
ces
offere
d by honeypot
syste
m
can
be reache
d
from outside net
w
orks
.
Som
e
t
echni
q
u
e
s f
o
r
fi
nge
rp
ri
nt
i
n
g
a TC
P/
IP
st
acks
ha
ve
be
en
pr
o
pose
d
,
b
u
t
t
h
ey
were
e
v
ade
d
easi
l
y
w
i
t
hout
doi
ng
a l
o
t
o
f
c
h
an
ges
i
n
h
one
y
pot
c
ode
.
Sp
itzn
e
r said
th
at in
o
r
d
e
r to av
o
i
d
fing
erprin
tin
g
,
realism
m
u
st b
e
d
e
v
e
lop
e
d, b
l
en
d it with
th
e
envi
ro
nm
ent
and
m
odi
fy
h
o
n
e
y
pot
beha
vi
o
r
[1]
.
H
o
weve
r,
i
n
case
o
f
l
o
w i
n
t
e
ract
i
o
n
ho
ney
p
o
t
s
,
i
n
c
r
easi
n
g
t
h
e real
i
s
m
m
e
ans t
o
pr
og
ram
bet
t
e
r net
w
o
r
k
servi
ce em
ul
ators
wi
t
h
m
o
re feat
ure
s
, an
d a
s
a conse
q
uenc
e, t
o
increase t
h
e i
n
teraction offe
re
d
by them
.
The
rem
i
nder
of
t
h
e
pa
per
i
s
o
r
ga
ni
zed
as
f
o
l
l
o
ws:
I
n
S
ect
i
on
2 t
h
e
b
ackg
r
ou
n
d
i
s
di
vi
de
d i
n
t
o
h
o
n
e
ypo
ts
and
f
i
ng
erpr
in
ting.
In
Sectio
n 3
w
e
d
e
tail
di
f
f
e
r
ent
sc
hem
e
s use
d
f
o
r
depl
o
y
i
ng l
o
w
i
n
t
e
r
act
i
on
ho
ney
p
o
t
s
an
d
t
h
e di
ffe
re
nt
ap
pr
oac
h
es o
f
fi
n
g
er
pri
n
t
i
ng a r
e
m
o
t
e
net
w
o
r
k
sy
st
em
. In Sect
i
on 4 we
det
a
i
l
our
pr
o
pose
d
s
o
l
u
t
i
on.
Sect
i
on
5
sho
w
s
obt
ai
n
e
d res
u
l
t
s
aft
e
r t
e
st
i
ng di
ffe
rent
L
o
w
Int
e
ract
i
on
Ho
ney
pot
s
.
C
onsi
d
eri
ng
o
u
r re
sul
t
s
, Sec
t
i
on 6 d
e
scri
b
e
s a di
scussi
o
n
. I
n
Sect
i
o
n 7, C
o
ncl
u
si
on
s
and F
u
t
u
re
Wor
k
are
gi
ve
n. Fi
nal
l
y
we
l
i
s
t
R
e
fere
n
ces.
2.
BA
C
KGR
OUN
D
2.
1. Ho
ney
p
o
t
s
H
o
n
e
ypo
ts can b
e
classif
i
ed
by th
eir
fu
n
c
tion
in
: r
e
sear
ch
o
r
p
r
od
u
c
e honeyp
o
t
s an
d
also
in
l
o
w
and
h
i
gh
in
teraction
hon
eypo
ts,
b
y
co
mm
an
d
s
, lib
raries and
ap
p
lication
s
they o
ffer.
A Honey
n
et is a special
net
w
or
k c
o
m
poses
by
m
a
ny
sy
st
em
s and a
h
oney
pot
gat
e
w
a
y
.
Pro
d
u
ct
i
o
n ho
ney
p
o
t
s
are de
pl
oy
ed i
n
or
ga
ni
zat
i
ons wi
t
h
t
h
e pu
rp
ose o
f
gi
vi
n
g
a set
of sy
st
em
s
t
o
the blac
k hats, where
they
can
wa
st
e t
h
ei
r t
i
m
e
and c
o
m
put
at
i
onal
r
e
so
ur
ces (p
ro
cesso
r
ti
m
e
,
m
e
m
o
r
y
,
net
w
or
k t
i
m
e
and
ba
nd
wi
dt
h
,
am
ong ot
he
r
s
.),
by
m
a
i
n
t
a
ini
n
g t
h
e p
r
od
u
c
t
i
on sy
st
em
s
i
n
safe.
Usual
l
y
,
for
p
r
od
u
c
tion
hon
eypo
ts, informatio
n
is fab
r
i
cated
and
pu
t it in
sid
e
th
e syste
m
, in
o
r
d
e
r
to
co
nfu
s
e th
e b
l
ack
hats. E
x
am
ples of s
u
c
h
data fabrication are:
the creatio
n o
f
fake
user
’s ac
cou
n
t
s
,
do
cum
e
nt
s an
d di
rect
ori
e
s,
access to the s
y
stem
, connect
ions to
other s
y
stem
s and sy
stem
logs.
W
e
should
pay attention t
o
the tim
e of
dat
a
fab
r
i
cat
i
o
n an
d creat
e c
o
nsi
s
t
e
nt
dat
a
;
o
t
her
w
i
s
e, a bl
a
c
k hat
co
ul
d i
d
ent
i
f
y
fab
r
i
cat
ed dat
a
,
fo
r exa
m
pl
e,
a direct
ory i
n
si
de t
h
e
user home w
ith wrong perm
issions and
create
d
i
n
form
ation
without a pre
v
ious acces
s
of t
h
e
use
r
, a
m
ong ot
hers
.
The m
a
in func
tions
of this
ki
nd of
honeypots are to de
fe
nd the
organiza
tion
by
causing decept
i
on
to black ha
ts.
The
product
i
on honeypots usually
are
inst
alled ove
r a
ha
rdware a
n
d s
o
ftware
sim
i
l
a
r t
o
t
h
e
p
r
o
d
u
ct
i
o
n
ser
v
ers i
n
o
r
gani
za
t
i
ons.
They
c
a
n
be i
n
st
al
l
e
d
ov
er
vi
rt
ual
e
n
vi
r
onm
ent
s
t
o
o.
Research
h
o
n
e
yp
o
t
s are m
a
in
ly fo
un
d
at the u
n
i
v
e
rsities an
d
th
ei
r pu
rpo
s
e is to
learn
m
o
re ab
ou
t
b
l
ack
h
a
ts techn
i
qu
es
b
y
offerin
g
m
a
n
y
system
s
in
a wi
d
e
variety o
f
con
f
i
g
uration
s
.
Du
e to
m
a
n
y
u
n
i
v
e
rsitie
s
cann
o
t
a
f
f
o
r
d
n
e
w a
n
d
dedi
cat
ed c
o
m
put
ers,
ho
ney
p
o
t
s
a
r
e
usu
a
l
l
y
i
n
st
al
l
e
d
on
vi
rt
ual
e
n
vi
r
onm
ent
s
o
r
i
n
ol
d
har
d
ware com
put
e
r
s. C
o
m
m
onl
y
,
resea
r
c
h
ho
ney
p
o
t
s
ar
e part
of a bi
g de
pl
oy
ed
H
oney
n
et
i
n
di
f
f
ere
n
t
ca
m
p
u
s
and
u
n
iv
ersities.
Hi
g
h
i
n
t
e
ract
i
o
n h
o
n
ey
p
o
t
s
ar
e out
of t
h
e sc
ope
of t
h
i
s
pa
p
e
r beca
use t
h
e
y
are i
n
st
al
l
e
d ove
r a rea
l
ope
rat
i
n
g sy
st
em
and t
h
e se
rvi
ces t
h
ey
of
f
e
r are
not
em
ul
at
ors
.
H
o
we
ver
,
i
t
i
s
im
port
a
nt
t
o
say
t
h
at
hi
g
h
i
n
t
e
ract
i
on
h
o
n
e
y
pot
s are
de
p
l
oy
ed o
v
e
r
vi
rt
ual
en
vi
r
onm
ent
s
an
d t
h
e
gat
h
eri
ng
of i
n
f
o
r
m
at
i
on i
s
do
ne
ove
r
t
h
e vi
rt
ual
l
a
y
e
r, so
, t
h
e o
p
e
rat
i
ng sy
st
em
does
not
nee
d
any
m
odi
fi
cat
i
on [
2
]
.
On
t
h
e ot
he
r ha
nd
, l
o
w
i
n
t
e
ract
i
on
ho
n
e
y
pot
s o
ffe
r a wi
de va
ri
et
y
of
sy
st
em
s and s
e
rvi
ces em
ul
ators t
o
bl
ack ha
t
s
,
m
a
l
i
c
i
ous u
s
ers o
r
m
a
l
i
c
i
ous soft
ware
, k
n
o
w
n a
s
m
a
l
w
are. T
h
e
m
a
i
n
adva
nt
ages o
f
depl
oy
i
ng l
o
w i
n
t
e
ract
i
on
ho
ney
p
o
t
s
are t
h
e
wide a
r
ea t
h
ey can cover, t
h
e
low ris
k
t
h
ey
represe
n
t an
d t
h
e
vast
vari
et
y
o
f
se
rvi
ces
they can em
ulate. In
ad
d
ition
to
th
at, lo
w in
teracti
o
n
ho
n
e
y
p
o
t
s
co
u
l
d
b
e
fi
ng
erprin
ted
b
ecause th
ey u
s
e emu
l
ato
r
s and
h
a
v
e
less
fun
c
tion
a
lity th
an
real system
s
with
real
n
e
two
r
k
se
rv
ices and
th
e in
teraction
th
ey
offer is l
i
m
i
ted
.
In [3], a
u
thors
show s
o
m
e
features t
h
at
onl
y low
interacti
o
n honeypots
have
. M
o
st
of
them
can be
e
m
u
l
ated
, in
ex
am
p
l
e, b
y
sen
d
i
n
g
p
s
eu
do
ran
d
o
m
traffic to
h
o
n
e
y
p
o
t
s in
ord
e
r to
in
crease reality o
r
by
em
ul
at
i
ng a
fe
w sy
st
em
s t
o
avoi
d
ove
r-
hea
d
i
ng s
o
ft
wa
re.
The
ot
he
r
feat
ures
are
o
p
t
i
o
n
a
l
,
ext
e
n
s
i
v
e l
o
g
g
i
n
g
can be c
ove
red
wi
t
h
t
h
e use o
f
a Gat
e
way
H
oney
n
et
an
d b
a
nd
wi
dt
h rest
ri
ct
i
on i
s
desi
ra
bl
e but
al
so
op
t
i
ona
l
and
i
s
speci
fi
ed by
eac
h
or
ga
ni
zat
i
on.
O
n
l
y
one
feat
u
r
e i
s
i
nhe
re
nt
o
f
l
o
w
i
n
t
e
ract
i
o
n h
o
n
ey
p
o
t
an
d i
t
c
a
nn
ot
be c
h
an
ge
d, t
h
ey
do
n
o
t
i
m
pl
em
ent
a f
u
l
l
-fe
at
ure
d
net
w
or
k
ser
v
i
ces set
.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
J
ECE
I
S
SN
:
208
8-8
7
0
8
A New Pr
ocedure t
o
Detect Low Inter
a
ction
Honey
pots
(Gi
n
a Ga
llego
s-Ga
rcia
)
85
0
2.
2. Finger
printing
As bi
om
et
ri
c
fi
nge
rp
ri
nt
,
where a s
p
ecific
pattern is e
x
tra
c
ted and c
o
m
p
ared a
g
ainst a
database
, the
i
d
ent
i
f
i
cat
i
o
n
of
sy
st
em
s i
s
p
o
ssi
bl
e
d
u
e
t
o
t
h
e
di
f
f
er
ent
i
m
pl
em
entat
i
ons
o
f
c
o
m
m
uni
cat
i
on p
r
ot
oc
ol
s,
net
w
or
k se
r
v
i
ces o
r
s
p
eci
fi
c
envi
ro
nm
ents. These differe
n
t
features
a
r
e co
llected a
n
d then a
fingerprint is
gene
rat
e
d
,
w
h
i
c
h i
n
cl
u
d
e e
n
o
u
g
h
feat
ure
s
t
o
u
n
e
qui
vo
call
y
identify a specific syst
em
of a set
of
di
f
f
ere
n
t
syste
m
s. Some features that are
use
d
to i
d
entify systems are s
p
ecifi
c
res
p
onses t
o
m
a
lform
e
d queries
,
mistak
es in
the i
m
p
l
e
m
en
tat
i
o
n
s
lik
e m
i
ssp
elled
word
s i
n
er
ro
r m
e
ssages, t
y
pi
cal
b
e
havi
or l
i
k
e
s
p
eci
al
ch
aracters fo
r
p
a
th
s
o
r
a sp
ecific set o
f
add
r
esses, in
itial cou
n
t
ers or id
en
tificatio
n
n
u
m
b
e
rs, erro
r m
e
ssag
e
s
i
n
di
ffe
re
nt
an
om
al
ous
q
u
eri
e
s,
t
i
m
e
respo
n
se
or a
n
am
ou
nt
of
res
o
u
r
ces,
s
u
ch
as:
am
oun
t
of c
o
n
n
ect
i
o
ns a
n
d
ch
ild
p
r
o
cesses. In
o
r
d
e
r to
t
h
e fing
erprin
ting
too
l
lo
se
s ac
curacy, suc
h
fe
atures ca
n
be c
h
ange
d,
but some of
t
h
em
are very
di
ffi
c
u
l
t
t
o
c
h
a
nge
an
d
nee
d
a
hi
g
h
l
e
vel
pr
o
g
ram
m
i
ng.
As a
ge
neral
r
u
l
e
, a
ho
ney
p
o
t
sho
u
l
d
n
o
t
b
e
det
ect
ed
. Bu
t
if it is id
en
tified
,
it lo
ses all its v
a
lu
e. Fo
r
pr
o
duct
i
o
n h
o
n
ey
p
o
t
s
, t
h
e bl
ack hat
s
co
ul
d
chan
ge t
h
ei
r
target system a
nd attack
a p
r
o
duct
i
o
n sy
st
em
. As
a
conseque
nce,
they woul
d
be able to obt
a
in val
u
ab
le
inform
ation. More
ove
r,
in the
case of
researc
h
h
o
n
e
ypo
ts, th
e p
o
ssi
b
ility to
learn
abou
t b
l
ack
h
a
t co
mmu
n
ity b
e
co
m
e
s
i
m
p
o
ssib
l
e. To
prev
en
t and
h
i
nd
er
th
is po
ssi
b
ility
, th
e
go
od practices in
d
i
cate ch
ang
e
s to
t
h
e
d
e
fau
lt settin
gs. Howev
e
r, the arch
itectu
r
e
o
f
low
in
ter
actio
n honeyp
o
t
s m
a
k
e
s th
is task m
o
r
e
dif
f
i
cu
lt.
I
n
o
t
h
e
r
wor
d
s, it is
no
t custo
m
izab
l
e
.
There
are
t
w
o
way
s
t
o
a
v
oi
d
fi
n
g
er
pri
n
t
i
n
g:
scr
u
bbi
n
g
a
n
d
cam
oufl
a
gi
ng
. T
h
e
fi
rst
one
i
s
t
h
e
m
o
d
i
ficatio
n
of th
e ou
tpu
t
in
a co
mm
u
n
i
cati
o
n, wh
ere th
e fin
g
e
rprin
ting
to
o
l
can
n
o
t
d
e
term
in
e th
e id
en
tity o
f
the target syste
m
. The second one
ref
e
r
s
t
o
t
h
e
m
odi
fi
cat
i
on of
di
ffe
rent
ex
pect
ed o
u
t
p
ut
s of
ot
her
im
pl
em
ent
a
t
i
o
ns o
f
t
h
e p
r
ot
ocol
,
whi
c
h gi
ves as a resul
t
an exact
wr
o
ng m
a
t
c
h i
n
the fi
n
g
er
p
r
i
n
t
i
ng t
o
ol
.
Neve
rt
hel
e
ss
, i
f
t
h
e fi
nge
r
p
r
i
nt
seque
nce i
s
l
a
rge, t
h
e c
a
m
oufl
a
ge co
ul
d be al
m
o
st
as expe
nsi
v
e
as t
h
e
rede
pl
oy
m
e
nt
of a di
ffe
rent
p
r
ot
ocol
i
m
pl
em
ent
a
t
i
on. De
f
i
ni
t
i
ons o
f
o
n
-
l
i
n
e an
d o
f
f
-
l
i
n
e defe
nses a
g
ai
nst
t
h
e
fingerpri
n
ting
and their feat
ur
es can b
e
fo
und
in [4
].
In
add
itio
n, in [4
] au
thors
p
r
o
p
o
s
e m
i
n
i
m
u
m
set o
f
tests for
Nm
ap
, in
o
r
d
e
r to
fing
erp
r
i
n
t an
OS
with
ou
t th
e
u
s
e o
f
m
a
lfo
r
m
e
d
p
a
ck
ets, as
a co
n
s
equ
e
n
c
e a lo
w pro
b
a
bilit
y o
f
b
e
i
n
g
a Netwo
r
k
In
t
r
u
s
i
o
n
Det
ect
i
on
Sy
st
em
(NID
S) i
s
o
b
t
a
i
n
ed
. D
u
e t
h
e a
p
pl
i
cat
i
on fi
nge
r
p
r
i
nt
i
ng
uses c
o
m
p
l
e
t
e
hand
sha
k
e
co
nn
ection
s
, the prob
ab
ility o
f
sen
s
ing
it
o
r
b
l
o
c
k
i
ng
it is l
o
w.
3.
RELATED WORK
3.1. Schemes
for Deploying
Low Inter
a
c
t
ion
Honeypots
In t
h
i
s
sect
i
o
n,
fo
ur sc
hem
e
s
fo
r de
pl
oy
i
n
g l
o
w i
n
t
e
ract
i
o
n ho
ney
p
o
t
s
se
ns
ors a
r
e desc
ri
b
e
d, t
h
e
fi
rs
t
o
n
e
is th
e simp
lest sch
e
m
e
t
o
con
f
i
g
ure and
m
a
in
tain
th
em an
d
th
e fourth
o
n
e
is th
e
m
o
st co
m
p
lex
sch
e
m
e
.
They
are
de
scr
i
bed a
s
f
o
l
l
o
ws
an
d s
h
owe
d
i
n
Fi
g
u
re
1
.
Th
e
first sch
e
me is th
e in
st
allatio
n
and
co
nfigu
r
ation of a l
o
w in
teractio
n
ho
n
e
y
p
ot. Th
en
it
i
s
necessa
ry to assign a public IP and c
onn
ect it
to
th
e In
tern
et. Th
is sch
e
me is co
mm
o
n
ly u
s
ed
to
sense and
anal
y
zepr
o
pag
a
t
i
on m
e
t
hods
of
w
o
rm
s an
d I
n
t
e
r
n
et
t
r
af
fi
c s
t
at
i
s
t
i
c
s.
Th
e secon
d
sch
e
m
e
in
clu
d
e
s
also
th
e i
n
stallatio
n
an
d
con
f
i
g
uration
of a
pack
et filtering
firewall.
Its
m
a
i
n
fu
nct
i
o
n
i
s
t
o
redi
r
ect
s
p
eci
fi
c
net
w
or
k t
r
a
ffi
c
t
o
t
h
e
h
oney
pot
. I
n
or
der
t
o
re
di
re
ct
suc
h
t
r
a
ffi
c,
t
h
e
p
ack
et filtering firewall an
alyses n
e
two
r
k
traffic and
ch
eck
s
it ag
ain
s
t a ru
le set. If features
m
a
tch
with
a
ru
le,
th
e firewall red
i
rects su
ch
pack
ets to
th
e h
o
n
e
ypo
t. T
ypical ru
les are: filterin
g
so
urce an
d
d
e
sti
n
atio
n
IP,
destination
port and fla
g
s in t
h
e TCP pac
k
et
heade
r
.
Th
e th
ird
sch
e
me is si
mi
lar t
o
th
e seco
nd
on
e w
ith
th
e
d
i
fferen
ce th
at it
include
s a net
w
ork traffic
n
o
rm
alizer in
t
h
e p
a
ck
et filterin
g
fi
rewall, co
mm
o
n
l
y cal
le
d
scru
bb
er. Exa
m
p
l
es o
f
scrub
b
e
rs are: th
e
BSD's
IP-filter with t
h
e e
n
able
d opt
i
on sc
rub a
n
d
the use
of
IP
pers
onality or
a sim
ilar
m
odule for
IP
-Ta
b
les in
GN
U/
Li
n
u
x
.
M
o
re
ove
r, i
n
o
r
de
r t
o
rest
ri
ct
i
n
g
o
i
n
g an
d o
u
t
goi
n
g
net
w
o
r
k
t
r
affi
c, t
h
i
s
sc
hem
e
can al
so
i
n
cl
ude
a h
oney
pot
Gat
e
way
s
u
ch
as a
H
oney
-
wal
l
.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
SN
:
2
088
-87
08
IJECE Vol. 4, No. 6, D
ecem
ber 2014
:
848 – 857
8
51
Fi
gu
re 1.
The
Fo
ur Sch
e
m
e
s
fo
r Depl
oy
i
n
g
Lo
w
I
n
t
e
ract
i
o
n Ho
ney
p
o
t
.
After a kno
wn attack
h
a
s b
e
en
id
en
tified, th
e fou
r
t
h
sc
he
m
e
i
s
desi
gn
e
d
t
o
re
di
rect
n
e
t
w
o
r
k t
r
af
fi
c.
Thi
s
schem
e
includes an IPS that
senses
a
nd
re
di
rect
s net
w
o
r
k t
r
af
fi
c t
o
t
h
e h
o
n
ey-net. Such
redirection is us
ually
en
ab
led
for a
p
r
ev
iou
s
ly sp
ecified
ti
m
e
. Th
is sch
e
m
e
can
use a hon
ey
-n
et
Gateway t
o
o
and
sh
ou
ld b
e
th
e
p
r
ef
err
e
d sch
e
me f
o
r pro
d
u
c
t
i
o
n
of
h
o
n
e
ypots.
3.2.
Finger
printing a Remote Ne
twork Sys
t
em
There
are
t
w
o
m
e
t
hods
t
o
re
m
o
t
e
l
y
i
d
ent
i
f
y
a sy
st
em
i
n
a net
w
o
r
k
,
t
h
e
passi
ve a
n
d t
h
e act
i
v
e.
The
first one
uses
a network
sniffer a
n
d the
n
a
n
alyses a
ll net
w
ork traffic
passing by t
h
e
NIC. After t
h
a
t
and
co
nsid
eri
n
g
a d
a
tab
a
se, it tries to
id
en
tify th
e syst
e
m
.
Th
is k
i
n
d
of rem
o
te id
en
tificatio
n
will n
o
t
b
e
con
s
i
d
ere
d
i
n
t
h
i
s
pa
per
,
be
cause we d
o
not
c
o
nsi
d
e
r
passiv
e
id
en
tifi
catio
n
d
u
e
to
th
ere is
no
exist an
in
ter
actio
n
b
e
t
w
een
ho
n
e
y
p
ot an
d
b
l
ack
h
a
t, b
e
fo
r
e
su
ch
b
l
ack
h
a
t tak
e
co
n
t
r
o
l of
a ho
n
e
y
p
o
t
. Th
e second
one
se
nds
s
p
ec
i
f
i
c
req
u
est
o
v
e
r t
h
e
net
w
o
r
k
an
d t
h
e
n
a
n
al
yses th
e
respon
ses. After t
h
at, it d
e
term
in
ates th
e
id
en
tity o
f
rem
o
te syste
m
b
y
co
m
p
aring it ag
ain
s
t
a fing
erprin
t
datab
a
se.
Differen
t app
r
o
aches to
fingerpri
n
ting
a rem
o
te system
are e
xpl
ai
ne
d i
n
t
h
e
f
o
l
l
o
wi
ng
su
bsect
i
o
ns
.
3.2.1. I
n
ter
a
c
t
ive Fingerprinting
T
h
is
ap
pro
a
c
h
u
s
e
s
a w
e
ll-kno
wn
r
e
q
u
e
s
t
an
d a
s
a
conse
q
uence
it is ve
ry easy to
detect and eva
d
e.
Actu
ally lo
w in
teractio
n
h
o
n
e
ypo
ts h
a
ve th
e sa
m
e
fin
g
erprin
t and
it g
i
v
e
s th
e exact resp
on
se to
th
e
fi
n
g
er
pri
n
t
i
ng t
ool
.
The
s
e t
o
ol
s ha
ve a m
odul
e t
o
i
d
e
n
t
i
f
y
ne
t
w
o
r
k s
e
r
v
i
ces
and
are
base
d
on
o
ffe
red
ba
n
n
er
s
by rem
o
te ser
v
ices.
This a
p
proach
is useless
for a
ll schem
e
s even
Hone
yd du
e
to
itself is ab
le to
foo
l
th
e
fing
erp
r
i
n
ting
tool by re
pre
s
e
n
ting t
h
e pe
rsonality
of a honeypot accordi
n
g to the Nm
ap
or Xprobe
2
fingerpri
n
ting files
and
by res
p
onding the expected
values
for
s
u
c
h
t
o
ol
s [
2
]
.
I
n
[3]
,
a
n
a
n
al
y
s
i
s
of t
i
m
e t
e
chni
que t
o
det
ect
l
o
w
in
teractio
n
ho
neyp
o
t
s wit
h
goo
d
resu
lts in
local area wa
s
pr
opo
sed, wh
ich
r
e
qu
ir
ed
send
ing
a lo
t of
pack
ets
an
d
w
a
s v
e
r
y
dep
e
nd
en
t
of
n
e
tw
or
k
top
o
l
o
g
y
.
3.
2.
2. St
ati
s
ti
cal
Fi
n
g
erpri
nt
i
n
g
This approac
h
sends m
a
ny reque
sts and then applie
s a statistical analys
is ove
r recei
ve
d re
plies in
o
r
d
e
r t
o
id
en
tify th
e rem
o
te s
y
ste
m
. Th
is ap
p
r
o
a
ch
is v
e
ry
sen
s
itiv
e to
chan
g
e
s in
n
e
t
w
ork
topo
log
y
and
on
ly
can be s
u
ccess
f
ul in the first schem
e
in the
TCP/IP st
ack.
In the sec
o
nd
schem
e
could be when it is used i
n
n
e
two
r
k
serv
ices fin
g
e
rp
ri
n
tin
g. In
[3
], 4
9
qu
an
titativ
e and q
u
a
litativ
e featu
r
es to
fi
n
g
e
rprin
ting
TCP/IP stack
w
e
r
e
pr
opo
sed. I
n
su
ch
p
r
op
osal th
e an
alysis o
f
ti
m
e
is d
one ov
er
t
h
e r
e
spo
n
s
e of
I
C
MP
messag
e
s. Th
ey also
dem
onst
r
at
ed
h
oney
pot
sy
st
em
s resp
on
d slow
er th
an
r
eal
syste
m
s.
3.
2.
3. T
h
e Fuz
z
y
Appr
o
a
ch
The
use
o
f
fu
zzy
l
ogi
c,
as i
n
ot
he
r sce
n
a
r
i
o
s [
5
]
[6]
gi
v
e
s di
ffe
rent
a
d
vant
a
g
es.
I
n
a
ho
ney
p
o
t
s
det
ect
i
on
pr
oc
essgi
v
e
s
t
h
e a
dva
nt
age t
o
i
d
ent
i
f
y
t
h
e ki
nd
of
h
oney
pot
i
s
bei
n
g
used
. I
n
ot
her
w
o
r
d
s,
fr
om
a
set o
f
po
ssi
b
ilities, it is assig
n
e
d
a m
e
m
b
ersh
ip
g
r
ad
e, i
d
en
ti
fyin
g
in
t
h
is way, th
e m
a
j
o
r of th
em
. All o
f
th
is is
m
a
de i
n
orde
r t
o
get
such a
d
v
a
nt
age. B
a
se
d on t
h
e TC
P/
I
P
st
ack, t
h
e fi
n
g
e
rp
ri
nt
i
n
g pr
oc
edu
r
e can be e
v
ad
e
d
in
all sch
e
m
e
s
,
b
u
t
it is a u
s
efu
l
id
en
tificatio
n
m
ech
an
ism
.
Th
e
m
a
in
p
r
o
b
l
em
o
f
th
is app
r
o
a
ch
is th
e
Evaluation Warning : The document was created with Spire.PDF for Python.
I
J
ECE
I
S
SN
:
208
8-8
7
0
8
A New Pr
ocedure t
o
Detect Low Inter
a
ction
Honey
pots
(Gi
n
a Ga
llego
s-Ga
rcia
)
85
2
defi
ni
t
i
on o
f
t
h
e
m
e
m
b
ershi
p
fu
nct
i
o
ns f
o
r t
h
e f
u
zzy
sy
st
em
, whi
c
h de
pe
nds
on t
h
e am
ou
nt
o
f
feat
u
r
e
s
t
o
be
eval
uat
e
d. T
h
e
Xp
ro
be
2 t
o
ol
em
pl
oy
s t
h
i
s
app
r
oach
wi
t
h
t
h
e use o
f
IC
M
P
t
e
st
s. In [
7
]
,
a
det
a
i
l
e
d desc
r
i
pt
i
o
n
o
f
Xp
rob
e
2 and
its co
m
p
o
s
itio
n are g
i
v
e
n.
Fi
gu
re 2.
Pr
o
p
o
se
d pr
oced
u
r
e
f
o
r ge
nerat
i
o
n of
l
o
w-i
n
t
e
ract
i
on h
oney
pot
fi
nge
r
p
ri
nt
.
3.
2.
4. T
h
e
Net
w
ork Ser
v
i
ce
Appr
o
a
ch
Thi
s
ap
pr
oac
h
foc
u
ses
on
fi
nge
r
p
ri
nt
i
n
g
n
e
t
w
o
r
k se
rvi
c
e
s
. It
co
vers a
sm
al
l
am
ount
of c
o
m
put
ers
because it can only be
use
d
a
g
ainst system
s
that are offe
ri
ng the se
rvice.
Eve
n
this
approach se
em
s to
be the
m
o
st
li
mited
,
i
t
is th
e b
e
st o
p
tio
n
to
fi
n
g
e
rprin
t
lo
w i
n
teractio
n
hon
eypo
ts. Th
e
reason
t
o
u
s
e t
h
is app
r
o
a
ch
o
v
e
r
th
e o
t
h
e
r
o
n
e
s is th
at
n
e
tw
or
k serv
ices i
n
a
h
o
n
e
ypo
t ar
e em
u
l
ato
r
s an
d
t
h
ey ar
e limited
to
on
ly r
e
sp
ond
a sm
al
l
am
ount
o
f
re
que
st
s.
Thi
s
ap
p
r
oac
h
us
ual
l
y
em
p
l
oy
s fuzzy
l
o
g
i
c i
n
a hi
erarc
h
y
way
.
An
HTT
P
fi
n
g
er
pri
n
t
i
ng
i
s
prece
de
d by
a TC
P/
IP
fi
n
g
er
pri
n
t
i
n
g
p
r
ove e
v
e
n
t
h
o
u
gh
Nm
ap has
becom
e
l
e
ss effect
i
v
e
n
o
w
[4
].
I
n
[3
] au
th
or
s show
r
e
su
lts w
ith
d
i
ff
er
en
t f
eat
ure
s
in real services
,
m
o
re
over
Honeyd services were
gi
ve
n.
H
o
we
ve
r, i
t
di
d
n
o
t
ex
p
l
ai
n h
o
w
t
h
e
se
rvi
ces a
r
e t
e
st
.
Th
ere ex
ist
mo
du
les to
fing
erprin
t
i
n
g HTT
P
Serve
r
avai
l
a
bl
e t
o
Nm
ap
and
Xp
ro
be
2.
Thi
s
l
a
st
one
has al
s
o
a
m
odul
e t
o
t
e
st
HT
TP i
n
spi
t
e
of
i
t
i
s
o
n
l
y
use
d
t
o
hel
p
t
h
e i
d
en
t
i
f
i
cat
i
on o
f
t
h
e O
p
erat
i
n
g
Sy
st
em
.
In add
itio
n to th
at, t
h
ere ex
ist
m
a
n
y
i
m
p
l
e
m
en
tatio
n
s
of
Ho
n
e
y
d
that u
s
e d
i
fferen
t scripts to
im
p
e
rsonate as
HTTP services
. There a
r
e
other Honeyd
scri
pts servi
ces, such as: FTP a
nd Telnet
. Howe
ver,
nowa
d
ays they
have
bee
n
re
placed for newe
r prot
ocols
suc
h
a SSH.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
SN
:
2
088
-87
08
IJECE Vol. 4, No. 6, D
ecem
ber 2014
:
848 – 857
8
53
4.
SOLUTI
ON P
R
OP
OSED
4.
1. T
h
e Pr
oce
dure
The
pr
oce
d
u
r
e
we
use i
s
di
vi
d
e
d i
n
t
o
si
x st
ag
es as ca
n
be se
en i
n
Fi
g
u
r
e
2
.
The
fi
rst
st
e
p
det
e
rm
i
n
es
t
h
e si
m
u
l
a
ti
on
scenari
o
f
o
r
gene
rat
i
n
g fi
n
g
er
pri
n
t
s
. T
h
e
second
one
defines instance
s that we used in the
id
en
tificatio
n
p
r
o
cess. Th
e t
h
ird
st
age carries out a
proc
ess bet
w
een th
e syste
m
ev
alu
a
tio
n an
d Hon
e
ypo
t.
On
ce th
is
p
r
o
c
ess is co
m
p
lete
d
,
we an
alyzed o
b
t
ain
e
d
resu
l
t
s. After th
at, i
f
su
ch
resu
lts allo
w id
en
tifyin
g
th
e
Honeypot with a percenta
ge of acce
pt
able effective
n
ess; we procee
d to
gene
rate the Honeypot fingerprint
.
Othe
rwise,
we
adjust the inst
ances
or/and the eval
uation
process. This
stage is repeate
d
until an acceptable
p
e
rcen
tag
e
of i
d
en
tification
is ob
tain
ed.
Fig
u
re
3
.
Ou
r testin
g
scen
ario con
s
id
ers
four m
a
in
elem
en
ts
Tabl
e 1. Speci
f
i
cat
i
ons of sy
st
em
s
used
System
Processor
RAM
Ha
rd Dis
k
So
ftw
a
r
e
Honeypot
2 x 2.
24GHz
2 GB
80 GB
Honey
d
P
r
otection
Pentiu
m
4 2.
4GHz
1 GB
1x80GB
OpenBSD 3.
8
Honeynet Gateway
Pentiu
m
4 2.
4GHz
1 GB
1x40GB
Honey
W
all r
oo-
1.4
Referee
I
n
tel Cor
e
2 Duo 1
.
5GHz
4 GB
100GB
BackT
r
ack 4.
2
4.
2
Defi
ni
ti
on
of
Our
Si
mul
a
ti
on
Scen
ari
o
The L
o
w I
n
t
e
r
act
i
on
Ho
ney
p
o
t
sy
st
em
s have a l
i
m
i
t
e
d ran
g
e
of m
e
ssage
s t
h
at
can
res
p
on
d,
as
wel
l
as the am
ount
of services that
em
ulate.
On
e
o
f
t
h
e Low In
teraction
Hon
e
ypo
ts
h
a
s th
e gr
eatest num
b
er of
HTT
P
services emulators a
n
d
m
e
ssage i
s
¨
H
oney
d
¨
. C
onsi
d
eri
ng t
h
at
an
d wi
t
h
t
h
e i
n
t
e
ntion to
use a sim
u
lation scenari
o
as close as the
pr
o
duct
i
o
n,
we
pr
op
ose
d
t
o
u
s
e a t
opol
o
g
y
consi
s
t
i
n
g
of:
o
n
e Pac
k
et
Fi
re
wal
l
al
so cal
l
e
d H
oney
w
al
l
and
one
Ho
ney
P
ot
. The
Ho
ney
w
al
l
i
s
a sy
st
em
t
h
at
capt
u
r
es al
l
req
u
est
s
m
a
de i
n
the eval
uat
i
on
pr
ocess a
nd t
h
e Lo
w
I
n
ter
acti
o
n Hon
e
po
t.
Fi
gu
re
3 s
h
o
w
s m
e
nt
i
oned sc
enari
o
an
d
Tab
l
e 1 s
u
m
m
a
rizes their c
h
aract
eristics. In s
u
c
h
Ta
ble it is
im
port
a
nt
t
o
m
e
nt
i
on t
h
at
we di
d
use a
Ho
ney
d
fo
r i
n
st
al
l
i
ng Lo
w I
n
t
e
ract
i
o
n H
o
n
e
y
pot
, m
o
reo
v
e
r we di
d
i
n
st
al
l
W
e
b.s
h
as net
w
or
k em
ul
at
ors
,
A
p
ach
e scri
pt
1.
3.
23
,
IIS M
i
cro
s
o
f
t
em
ul
at
or II
S/
5.
0 an
d y
Ho
ney
w
e
b
0.
4 t
h
at
em
ul
at
es ve
rsi
o
ns
o
f
HTTP
i
m
pl
em
ent
a
t
i
on.
Honey
p
ot Syst
em
In
t
h
e
Hon
e
ypo
t we in
stalled
th
e GNU/Lin
ux
Deb
i
an
Op
erating
System
, v
e
rsio
n 6.0 and
k
e
rn
el
v
e
rsi
o
n 2.6.32 with
m
i
n
i
m
a
l in
stallatio
n
o
f
th
e system.
W
e
upd
ated ob
so
lete p
r
og
ram
s
, and
then
we
do
w
n
l
o
a
d
ed
pr
og
ram
s
for t
h
i
s
pro
f
i
l
e
(H
one
y
d
1.
5c versi
o
n, H
o
n
e
y
w
e
b
-
0
.
4
, ad
di
t
i
onal
scri
pt
s f
o
r S
U
SE and
Apac
he
We
b
Ser
v
er
ve
rsi
o
n
2.
2.
1
8
)
.
Fi
nal
l
y
we c
r
eat
ed
virtual system
s
that ha
ve
a
n
a
ssociated
IP a
d
dress
and
em
ul
at
ors scri
pt
of
HT
TP
.
Protection Sys
t
em
In
t
h
e
p
r
o
t
ector we in
stalled
t
h
e
Op
en
BSD
Op
eratin
g
Syst
e
m
v
e
rsion
4
.
8, we con
f
i
g
ured
th
e
IPfilter
and the
scrub function
was
enabled.
Honey
n
et Gat
e
way System
I
n
th
is syste
m
w
e
in
stalled
an
d
set up
th
e d
e
f
a
u
lt Ho
n
e
yW
all r
o
o
t
-200
904
251
145
42-
1.4.hw
.
W
e
defi
ned t
w
o
n
e
t
w
o
r
k ca
rd
s i
n
b
r
i
d
ge m
ode
and a t
h
i
r
d o
n
e f
o
r a
d
m
i
ni
st
rat
i
on.
We al
so
defi
ne
d
net
w
o
r
k
services
o
ffe
re
d
by
the a
d
m
i
nistration inte
rfa
ce.
W
a
lley
e
G
U
I
was
ena
b
le
d.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
J
ECE
I
S
SN
:
208
8-8
7
0
8
A New Pr
ocedure t
o
Detect Low Inter
a
ction
Honey
pots
(Gi
n
a Ga
llego
s-Ga
rcia
)
85
4
Tabl
e
2. C
o
m
p
ari
s
o
n
of
st
at
us
co
des
bet
w
ee
n
H
oney
d
em
ul
at
ors a
n
d
Apac
h
e
ser
v
er
.
Status Code
Ht
tpd Total Code
s
W
e
b
.
Sh
Apache.Sh
Lis.Sh
H
o
ney Web 0.
4
Successful (
2
xx
)
8
1
1
1
1
R
e
direction (
3
xx)
7 0
0
1
0
Client Error
(
4
xx)
22
1
1
1
5
Server Error
(
5
xx)
9 0
0
0
2
Tester System
In
ou
r t
e
st
er,
B
ackt
r
ack
Sy
st
em
Versi
on
4
.
2 wa
s i
n
st
al
l
e
d an
d t
h
e si
gnat
u
res
of t
h
e HTTP
ri
nt
Versi
o
n
0
.
3
0
1
were
u
pdat
e
d.
For
al
l
com
put
er eq
ui
pm
en
t we m
a
d
e
a mi
n
i
m
u
m
in
stalla
tio
n
o
f
t
h
e syste
m
and
al
so fo
r co
n
f
i
g
urat
i
o
n o
f
Se
b
e
k so
ur
c
e
code
(data capt
u
re t
ool,
whic
h cap
tu
res th
e activ
i
ties o
f
attack
ers o
n
a
H
o
n
e
ypo
t).
4.
3 Defi
ni
ti
on of
Ins
t
a
n
ces
During the
definition
of i
n
stances sta
g
e
we
m
a
de an evaluation through servic
e exercising
t
echni
q
u
es
t
o
i
d
ent
i
f
y
em
ul
at
ors
o
f
net
w
or
k se
rvi
c
e
o
f
Lo
w I
n
t
e
ract
i
o
n
H
o
ney
p
o
t
Sy
st
em
.Thi
s k
i
nd
o
f
ev
alu
a
tion
invo
lv
es a rem
o
te tester system
th
at u
nkn
own
s
th
e arch
itectu
r
e and
th
e rem
o
te syste
m
to
be
eval
uat
e
d, w
h
i
c
h i
s
kn
o
w
n a
s
bl
ack b
o
x
eval
uat
i
o
n. T
h
e
r
efore the sele
ction of instances contem
plates the
st
at
e codes
t
o
t
h
e a
n
s
w
ers
gi
v
e
n
by
H
o
ney
P
ot
.
The st
at
us co
d
e
s of HT
TP p
r
ot
ocol
are est
a
bl
i
s
he
d i
n
[8]
and [
9
]
and t
h
ey
are di
vi
d
e
d i
n
t
o
t
h
e
fo
llowing
fam
i
lies:
In
fo
rm
at
i
v
e 1x
x i
n
di
cat
es a
p
r
ovi
si
onal
res
p
o
n
se a
n
d i
s
onl
y
sent
t
o
cl
i
e
nt
s
i
n
t
e
rm
s of e
x
p
e
ri
m
e
nt
ati
on.
Success
2xx indicates that the
client re
que
st was receive
d, unde
rstood
and
accepte
d.
R
e
di
rect
i
o
n
3x
x
refe
rs t
o
f
u
rt
her
act
i
o
n
an
d
i
s
req
u
ired
b
y
t
h
e
u
s
er ag
en
t t
o
co
m
p
lete th
e requ
est.
4
x
x
is related to
clien
t
erro
r th
at h
a
pp
ens
wh
en re
quest iss
u
ed by t
h
e clie
nt ha
s error.
Ser
v
er
Er
ro
r
5
x
x
occ
u
rs
whe
r
e the se
rve
r
is
una
ble to
pe
rf
o
r
m
the req
u
est.
As pa
rt of
defi
nition of insta
n
ces we com
p
ared the
states codes found in the source code
of
diffe
rent
em
ul
at
ors
of
H
TTP t
o
H
oney
d
a
g
ai
nst
t
h
ose
o
n
e f
o
un
d i
n
t
h
e i
m
pl
em
ent
a
t
i
on
of
A
p
ache
W
e
b Se
rve
r
2.
2.
1
8
,
th
e resu
lt of such
co
m
p
ariso
n
is sho
w
n
i
n
Tab
l
e 2.
Fi
gu
re
4.
The
i
d
ent
i
f
i
cat
i
o
n
pr
ocess t
h
at
i
s
m
a
de
by
t
h
e
HT
TPri
nt
i
s
f
ool
e
d
by
H
o
ney
d
4.
4 E
val
u
a
ti
o
n
o
f
L
o
w
In
te
racti
o
n
Ho
ney
p
ot
s
As we m
e
nt
i
o
n
e
d be
f
o
re,
o
u
r
sim
u
l
a
t
i
on sce
n
ari
o
de
pi
ct
ed
i
n
Fi
g
u
re
3,
ha
s a rem
o
t
e
com
put
e
r
t
h
at
i
s
respon
sib
l
e fo
r th
e ev
alu
a
tion an
d
th
e i
n
teractio
n
with
a
r
ch
i
t
ect
ure of L
o
w-
Int
e
ract
i
on
Ho
ney
p
o
t
.
I
n
a
ddi
t
i
o
n
t
o
t
h
at
we p
r
o
p
o
se re
que
st
s i
n
ject
i
on
of t
y
pe
HTTP
, w
h
i
c
h
are m
a
de by
t
e
st
er sy
st
em
. Such re
quest
s a
r
e
m
a
de
with the
aim
that Honeypot a
n
sw
ers
them
according t
o
the
c
h
aract
eristics
of eac
h em
ulator
has.
In the tester sy
ste
m
we activate the
W
h
ireshark tool
t
o
ca
pt
ure t
h
e
net
w
o
r
k t
r
affic that is excha
n
ge
d
b
e
tween
t
h
e tester system
an
d
th
e Hon
e
yd
arch
itecture.
In
add
itio
n to
t
h
at we
d
i
d ru
n HTTPri
n
t
too
l
with
th
e
in
ten
tio
n
o
f
o
b
serv
i
n
g
wh
at re
m
o
te syste
m
was id
en
tified
d
u
ring
ev
al
u
a
tio
n.As is po
ssi
ble to
see in
Fig
u
r
e
4
,
fing
erp
r
i
n
tin
g
id
en
tificatio
n
p
r
o
cess th
at is
mad
e
b
y
t
h
e
H
TTPri
nt
, i
s
fo
o
l
ed by
H
oney
d
beca
use i
d
ent
i
fy
i
ng
em
ul
at
ors l
i
k
e
t
h
ey
were
HTT
P
ser
v
ers
.
A
f
t
e
r t
h
at
, w
e
di
d p
r
ocee
d t
o
a
n
al
y
ze i
n
f
o
rm
at
i
on of st
ore
d
fl
ows
a
n
d
requ
ests m
a
d
e
b
y
th
e tester sy
ste
m
.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
SN
:
2
088
-87
08
IJECE Vol. 4, No. 6, D
ecem
ber 2014
:
848 – 857
8
55
5.
RESULTS
The first pa
ra
m
e
ter we con
s
ider
i
n
o
u
r
anal
y
s
i
s
i
s
t
h
e
num
ber o
f
st
at
us co
des im
pl
em
ent
e
d i
n
Ho
ney
d
HTT
P
scri
pt
s.
As
w
e
di
d m
e
nt
i
o
n
bef
o
re
t
h
ey
a
r
e de
fi
ne
d [
8
-
10]
a
nd as
a
resul
t
o
f
pcap
fi
l
e
s
analysis, we
observe t
h
at HTTPri
nt tool
makes 23
requ
ests to d
e
fine th
e
k
i
nd
o
f
rem
o
te syste
m
to
be
id
en
tified.
The a
n
al
y
s
i
s
o
f
t
h
e
num
ber
of st
at
u
s
co
de
s im
pl
em
ent
e
d i
n
H
oney
d
H
TTP scri
pt
s a
nd i
n
a real
HTTP serve
r
s
h
ows
us
a si
gnificant di
ffe
rence betwe
e
n
the
m
. Table 2 s
u
mmarizes the num
b
er of status code
s
of
fere
d
by
A
p
ache ht
t
pd
2.
2.
18
(
H
TTP
D)
,
by
t
h
e H
o
ney
d
scri
pt
s
web
.
sh
(
W
EB
),
by
ap
ache.s
h
(
A
P
A
C
H
E)
,
by
i
i
s
.sh
(
IIS
)
f
r
om
Ho
ney
d
sc
ri
pt
s
fo
r S
U
SE
and
W
i
nd
o
w
s
and
fi
nal
l
y
Ho
ney
W
e
b
0.
4
(H
WEB
)
.
As i
s
s
h
o
w
n
in Figure
5, after exec
ution
of
HTT
P
ri
nt against
Ho
n
e
yd scr
i
p
t
s, th
e
new
sign
atur
es
w
e
r
e
ob
tain
ed
. Such
sig
n
a
t
u
res
were written
i
n
the sig
n
a
t
u
res.txt file with
th
e n
a
m
e
o
f
corresp
ond
en
t
em
u
l
ato
r
. Th
en
we rep
e
at
p
r
ev
iou
s
tests
an
d fo
r all of t
h
em
we d
i
d g
e
t
a 100
%
o
f
id
en
tificatio
n
.
Fi
gu
re
5.
S
u
cc
essful
det
ect
i
o
n
of
H
o
n
e
y
d
H
TTP sc
ri
pt
s a
f
t
e
r re
-r
u
nni
ng
HTTP
ri
nt
t
ool
.
Fi
gu
re 6.
Ne
w obt
ai
ne
d si
g
n
at
ures
o
f
Ho
ney
d
HTTP
scri
pt
s
.
M
o
re
ove
r, e
v
e
n
i
f
H
oney
W
e
b
i
s
a
b
l
e
t
o
e
m
ul
at
e 4 ve
rsi
ons
o
f
IIS
,
8
versi
o
n
s
o
f
A
p
ache
an
d
3
v
e
rsi
o
ns of Netscap
e En
terp
rise, a si
ng
le sig
n
a
t
u
re allo
ws
d
e
tecting all v
e
rsion
s
. After t
h
at, th
e new
si
gnat
u
res we
r
e
adde
d t
o
pre
v
i
o
us o
n
es an
d
re-r
un
HTTP
ri
n
t
with
all Ho
neyd
scrip
t
s su
ccessfu
lly d
e
tected
. It
i
s
prese
n
t
e
d i
n
Fi
gu
re
6.
In a
d
di
t
i
on,
d
u
e t
o
t
h
e fi
nge
r
p
ri
nt
i
ng
ser
v
i
ce i
s
m
a
de o
v
e
r
a
val
i
d
co
n
n
ect
i
o
n a
nd t
h
e
hu
ge am
ount
o
f
p
o
ssi
bl
e
que
r
i
es, t
h
i
s
m
e
t
h
o
d
i
s
m
o
re di
ffi
cul
t
t
o
be i
d
e
n
t
i
fi
ed by
an
ID
S. As a c
o
n
s
eq
uence
,
it is
o
n
l
y i
m
p
o
r
tan
t
to
m
a
k
e
a
m
o
d
i
ficatio
n in
th
e q
u
e
ry,
su
ch
as: d
o
the requ
est GET / HTTP/1
.1
, in
crease
Evaluation Warning : The document was created with Spire.PDF for Python.
I
J
ECE
I
S
SN
:
208
8-8
7
0
8
A New Pr
ocedure t
o
Detect Low Inter
a
ction
Honey
pots
(Gi
n
a Ga
llego
s-Ga
rcia
)
85
6
t
h
e fi
el
d
of t
h
e
ve
rsi
o
n
or
s
u
b
v
ersi
on
o
r
c
h
a
nge
a si
ngle
c
h
aracter in the
GET
/a
n
tid
isestab
lish
m
en
tarian
ism
HTTP/
1
.
0
que
r
y
. I
n
Ta
bl
e 3
t
h
e re
pl
i
e
s t
o
HT
TPri
nt
a
r
e
pre
s
ent
e
d.
6.
DIS
C
USSI
ON
Fro
m
ob
tain
ed
resu
lts
we can
state th
e fo
llowing
im
p
o
r
tan
t
po
in
ts:
The
HTT
P
em
ul
at
ors
f
o
r
H
o
n
e
y
d
an
swe
r
ver
y
di
ffe
re
nt
l
y
t
o
HTT
P
ri
nt
re
q
u
est
s
.
Web.s
h
em
ulators
,
a
p
ache
.
s
h
and honeywe
b.sh
do
not se
nd
any answe
r
to reque
sts Ht
pri
n
t.
The a
p
ache.s
h
e
m
ulators, iis.s
h a
nd
honey
w
e
b
se
nd
stat
us c
ode
s of s
u
cces
s when t
h
ey s
h
oul
d se
nd client
er
ro
r cod
e
s.
The
web
.
sh a
n
d we
b.s
h
em
ul
at
ors se
n
d
st
at
us c
odes
o
f
error
when t
h
ey should
send
status c
odes
of serve
r
er
ro
r.
The
differe
n
ce
betwe
e
n HT
T
P
em
ulators for
Honeyd and
a real
HTTP s
e
rve
r
is
ve
ry st
rong
due
to t
h
ese
l
a
t
t
e
r im
pl
em
ent
s
, i
n
a m
o
re c
o
m
p
l
e
x way
,
st
at
us c
odes
i
n
t
h
e
pr
ot
oc
ol
st
a
nda
r
d
a
n
d
n
o
t
j
u
st
a
p
o
rt
i
o
n.
B
e
i
ng t
h
e sa
m
e
HTTP em
ul
at
ors
fo
r H
o
ney
d
, t
h
e sam
e
answe
r
f
o
r
HTTP
ri
nt
re
q
u
e
st
s i
s
prese
n
t
e
d
,
rega
rdl
e
ss
o
f
t
h
e
di
st
ri
b
u
t
i
o
n
of
t
h
e
O
p
era
ting System
or their res
p
ective a
r
chitecture.
Tab
l
e
3
.
Resu
lts of
th
e an
alysi
s
of
stor
ed
f
l
ow
.
HT
TPRIN
T QUE
RY
H
TTPD
WEB
APAC
HE
IIS
HWE
B
garba
ge
501
-
-
400
-
GET /
HTT
P
/1.0
200
404
200
200
200
GET /
HTT
P
/1.0
(*)
200
404
200
200
200
OPTI
ONS * HTT
P
/1.0
200
404
501
400
200
OPTI
ONS / HTT
P
/
1
.0
200
404
501
400
200
GET /antidisestablishmentarianism HTTP/1.0
404
404
400
302
200
PUT /
HTT
P
/1
.0
405
404
501
400
-
JUNKMETH
OD /
HTTP/1.0
501
404
501
400
-
GET J
U
NK /1.0
200
404
501
400
-
get / http/1.0
501
404
501
400
-
POST /
HTTP/1.0
200
404
501
400
200
GET /cgi
-bin/ HTT
P
/1.0
403
404
400
302
200
GET/scripts/ HTT
P
/1.0
404
404
400
302
200
GET /
HTT
P
/0.8
200
404
501
400
200
GET /
HTT
P
/0.9
200
404
501
400
-
GE
T / HTTP
/1.
1
C
onnection:
close
200
404
200
200
200
GE
T / HTTP
/1.
2
C
onnection:
close
200
404
501
400
200
GET /
HTT
P
/1.1
(**)
400
404
200
200
200
GET /
HTT
P
/1.2
(**)
400
404
501
400
200
GET /
HTT
P
/3.0
200
404
501
400
200
GET /
.
asmx
HTTP
/1.0
404
404
400
302
-
GET /
../.
.
/ HT
TP/1
.0
400
404
400
302
200
7.
CO
NCL
USI
O
NS A
N
D
FUT
URE WO
RK
The fi
n
g
er
pri
n
t
i
ng of
TC
P/
I
P
st
ack
is
useles
s against com
m
on low i
n
teraction
honeypots due t
o
the
am
ount
o
f
cha
r
act
eri
s
t
i
c
s and
l
i
m
i
t
e
d respo
n
s
es of s
p
eci
fi
c req
u
est
.
Ne
ve
r
t
hel
e
ss, l
o
w i
n
t
e
ract
i
on h
o
n
e
y
pot
s
are su
scep
tib
le to
fing
erprin
t
o
f
n
e
t
w
ork
serv
ices.
It is
bec
a
use of
the
differe
n
ces betwe
e
n
a
real service
and
em
ul
at
or sc
ri
pt
s.
Finge
rprinting
of
network services is s
u
cces
sful
b
eca
use
of the am
ount of availa
ble opt
i
ons i
n
the
con
s
t
r
uct
i
o
n o
f
queri
es
, m
a
king t
h
e fi
nge
r
p
ri
nt
i
n
g t
ool
s h
a
rd t
o
be
det
ect
ed. M
o
re
o
v
e
r
, t
h
e at
t
ack coul
d be
mad
e
in
a lo
n
g
p
e
riod
of ti
m
e
, redu
cing
in
this way, a p
o
ssi
b
l
e id
en
tificatio
n
o
f
th
e t
o
o
l
.
In
ad
d
ition
it i
s
v
e
ry
conce
r
ni
n
g
t
h
a
t
t
h
ere a
r
e t
ool
s rea
d
y
t
o
det
e
ct
l
o
w i
n
teract
io
n
ho
n
e
y
p
o
t
s
su
ch
as:
HTTPrin
tth
at is a way to
g
e
n
e
rate
n
e
w
fing
erp
r
i
n
ts and
add
th
em
to sign
atures
files. In add
itio
n to
t
h
at, t
h
e
use of
fuzzy log
i
c in
f
i
ng
erp
r
i
n
tin
g
to
o
l
s in
cr
eases su
ccess
r
a
te
o
f
i
d
en
tif
ication
.
M
o
r
e
o
v
e
r
,
n
o
w
a
d
a
ys, as
w
e
h
a
v
e
f
ound
, l
o
w
i
n
t
e
ract
i
on
h
o
n
ey
p
o
t
s
nee
d
t
o
be
i
m
prove
d
i
n
o
r
de
r t
o
en
sure their co
rrect fu
n
c
tion
a
l
ity. Oth
e
rwise, th
ey
shoul
d
not be
deploye
d
as researc
h
hone
y
pots. Unfo
rtunately, recent
activity
in s
o
m
e
low interaction
ho
ney
p
o
t
s
se
ns
ors
p
r
o
j
ect
s i
s
nul
l
.
As
fu
ture work
,
a research
on
d
e
tecting
h
i
gh
in
te
raction
ho
n
e
y
p
o
t
s
will b
e
don
e, in
add
itio
n
to
t
h
e
creat
i
on
o
f
a
fi
n
g
er
pri
n
t
i
ng
t
ool
o
f
l
o
w i
n
t
e
ract
i
on
ho
ne
y
pot
s i
n
o
r
de
r
t
o
be
use
d
i
n
di
ffe
rent
net
w
o
r
k
servi
ces
. Fi
nal
l
y
,
i
t
i
s
im
port
a
nt
t
o
m
e
nt
i
o
n
t
h
at
anot
he
r chal
l
e
nge
wo
ul
d be t
o
de
si
g
n
a fi
nger
p
ri
nt
i
ng t
o
ol
th
at is ab
le t
o
i
d
en
tity wh
at
k
i
n
d
of
ho
n
e
y
p
o
t
sch
e
m
e
is b
e
ing
u
s
ed
.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
SN
:
2
088
-87
08
IJECE Vol. 4, No. 6, D
ecem
ber 2014
:
848 – 857
8
57
REFERE
NC
ES
[1]
Spitzner
L
.
The
Honeynet
Proj
ec
t: Trapping th
e
Hackers
. I
EEE Security
and
Priv
acy
,
Vol 1
,
No
.
2. 2003
. Pp: 15-
23.
[2]
Provos N,
Holz T.
Virtual Honeypots: From Botnet
Tracking to Intrusion Detection
. 1st Edition
,
Addison
W
e
sle
y
Professional.200
7.Pp: 19-69.
[3]
Mukkamala S,
Yendrapalli K,
Basnet
R, Shank
a
rapan
i
M.K. Su
ng A. H.
Detection of Virtua
l En
vironments and
Low
Interaction Hon
eypots
.In
Proc
. I
EEE Workshop on Information
Assu
rance and
Security
.2007
. Pp
: 92-98.
[4]
Greenwald Llo
yd G, Thomas
Tavar
i
s J.
Tow
a
rd Undetected
Operating System Fingerprinting
. In
Proc
. F
i
rs
t
USENIX Worsh
op of Offensiv
e
Tec
hno
logies.20
06. Article No. 6
.
[5]
Godbole Vaibh
a
v.
Performance
Analysis of Cluste
ring Proto
c
ol
Using Fuzzy Logic
for W
i
reless
Sensor Network.
International Jou
r
nal of
Artif
icial
Inte
lligen
ce.Vol. 1. No
. 3
.
2012
.
Pp: 103-111.
[6]
Ham
zah M
u
s
t
af
a I, Abda
ll
Turki
Y.
Mobile Robo
t Naviga
tion using Fu
z
z
y
logi
c a
nd Wavel
et N
e
tw
or
k.
International
Journal of Robo
tics and
Automation.Vol. 3. No. 3
.
2014
. Pp: 191-
200.
[7]
Yarochkin F.
V, Arkin O,
Ky
dy
raliev M,
Shih-Yao D.
Xprobe2++: Low Volume Remote Ne
twork Information
Gathering
. In
Pr
oc
. I
E
EE/IFIP In
ternational Conf
erence on
De
pen
d
able S
y
stems & Ne
tworks.2009.Pp: 205-210.
[8]
Fielding R
,
Getty
s J, Mogul
J,
Fr
y
s
ty
k H, Mas
i
nter
L,
Leach P,
Berners-Lee T.
Hypertext tra
n
sfer Protocol -
-
HTTP
/1.
1
.
RFC 2616
, 1999
.Pp:
39-41.
[9]
Khare R
,
L
a
wre
n
ce S
,
Upgradin
g
to TLS Within
HTTP/1.1. RFC
2817
.2000. Pp:
8.
[10]
Nielsen H, Leach
P,
La
wre
n
ce
S.
An HTTP Exten
s
ion Framework. RFC 2774
.200
0. Pp: 8-13
.
BIOGRAP
HI
ES OF
AUTH
ORS
Ele
a
zar Aguirr
e
-
Anay
a
holds a Ph.D. degree
on Communicat
ions and Electr
onics. He is
profes
s
o
r at th
e
Center f
o
r Res
e
a
r
ch in Com
pu
tin
g the Na
tiona
l P
o
l
y
te
chnic
Instit
ute of Mex
i
co
.
He has been involved as infor
m
ation securit
y
specialist in con
s
ulting projects for public and
private organizations;
Aguirre-
A
nay
a
also has
published pa
p
e
rs on research
journals and
conferen
ces
and
has
s
e
rved
as
thes
is
advis
o
r
for several gr
ad
uate students o
n
information
s
ecurit
y
topics
.
His
m
a
in res
earch
topics
ar
e network security
, hon
ey
nets and secure
infrastructures.
Gina Gallegos-Garcia
rece
ived
a MS Degree and Ph. D from
the Nationa
l Pol
y
t
echni
c Institut
e
of Mexico
in
20
05 and 2011
res
p
ectively
.
She is
currently
Prof
essor of Graduated Section
of
Mechanical and
Electr
ical Eng
i
neer
ing School and bel
ongs to the National Sy
stem of
Research
ers. D
u
ring th
e summer of 2011 s
h
e pe
rformed
a postdoctor
a
l r
e
search
at Yale
Univers
i
t
y
in the
United S
t
ates
o
f
Am
erica. Her
areas
of int
e
res
t
includ
e The E
l
e
c
troni
c Voting,
the Secur
e
Cr
y
p
tographic Applic
ation Design
, Inf
o
rmation S
y
stem
s and Cr
y
p
togr
aph
y
, Softwar
e
Engineering.
Nic
o
las Solano
L
una
received
a
M
E
Degree from
the National
P
o
l
y
t
echni
c Ins
t
i
t
ute of M
e
xico
in 2012. He is
currently
working in th
e Fe
d
e
r
a
l Economical
Competence Co
mmission as a
com
puter foren
s
ics
inves
tigato
r
. His
areas
of interes
t
in
clud
e network s
ecu
rit
y
, com
puter
forensics and
mobile devices security
.
Luis Alfonso Villa Vargas
holds a Ph.D. degree o
n
Informatics.
H
e
is the prin
cipa
l
at the C
e
nte
r
for Resear
ch in
Com
puting the
Nationa
l Pol
y
te
c
hni
c Ins
t
i
t
ute o
f
M
e
xico. H
e
has
been invo
lved
as inform
ation securi
t
y
spe
c
i
a
list
in consulting pr
ojects for public
and priv
ate organiza
tions.Vil
la
Vargas also has published papers on resear
ch
journals
and
conferen
ces
.
He perform
ed
a
postdoctoral r
e
search
at
the Massachus
et
ts Institu
t
e
of
Technolog
y
(MIT).
Evaluation Warning : The document was created with Spire.PDF for Python.