Dulaunoy Honeybot Introduction
of 21
-
Upload
chepimanca -
Category
Documents
-
view
217 -
download
0
Transcript of Dulaunoy Honeybot Introduction
-
8/9/2019 Dulaunoy Honeybot Introduction
1/21
HoneyBotDecoy Devices for Security Monitoring inEmergency & Mobile Network
Alexandre Dulaunoy, SES ASTRA
Partially funded by U-2010, an Integrated Research Project
of the 5th Call in the 6th European Research Framework Program
-
8/9/2019 Dulaunoy Honeybot Introduction
2/21
Problem statement :
Emergency networks have to run before we
can secure and monitor them
-
8/9/2019 Dulaunoy Honeybot Introduction
3/21
Decoy Devices
Decoy devices are used to fool the attackers
But also exists in computer network security
to discover attackers on large-scale networks
-
8/9/2019 Dulaunoy Honeybot Introduction
4/21
Decoy Devices(low-interaction honeypot)
In computer network security,
a honeypot is a trap set to detect, deflect,
or in some manner counteract attempts atunauthorized use of information systems.
A Technique of Security Monitoring
-
8/9/2019 Dulaunoy Honeybot Introduction
5/21
HoneyBotLeverage of honeypot technology in emergency and mobile network
Limited false-positive and information overload
only a target for suspicious activities
Fast deployment and fast monitoringplug&forget
HoneyBot Devices are unmanned during operation
-
8/9/2019 Dulaunoy Honeybot Introduction
6/21
MonitoringSecurity Visualization to The Rescue
Gathering suspicious activities is only a part
of security monitoring...
Information security specialist are required
for interpretation
But its a difficult resource to find during
emergency
-
8/9/2019 Dulaunoy Honeybot Introduction
7/21
MonitoringSecurity Visualization to The Rescue
HoneyBot Sensor
-
8/9/2019 Dulaunoy Honeybot Introduction
8/21
MonitoringSecurity Visualization to The Rescue
Security events over time
-
8/9/2019 Dulaunoy Honeybot Introduction
9/21
MonitoringSecurity Visualization to The Rescue
Security events over time
current
past
-
8/9/2019 Dulaunoy Honeybot Introduction
10/21
MonitoringSecurity Visualization to The Rescue
Security events over time on a same
service (color-map increased)
-
8/9/2019 Dulaunoy Honeybot Introduction
11/21
MonitoringSecurity Visualization to The Rescue
Security events over time on a same
service (color-map increased)
Targeted attack on a service
-
8/9/2019 Dulaunoy Honeybot Introduction
12/21
MonitoringSecurity Visualization to The Rescue
Security events on a short period ondifferent services
-
8/9/2019 Dulaunoy Honeybot Introduction
13/21
MonitoringSecurity Visualization to The Rescue
Security events on a short period ondifferent services
Port scanning - attack network probe
-
8/9/2019 Dulaunoy Honeybot Introduction
14/21
HoneyBotCombining Security Visualization and Honeypot Technologies
Increase accessibility of security monitoring
Ease interpretation of security events
Limiting the effect of information overload
Still a research area...
-
8/9/2019 Dulaunoy Honeybot Introduction
15/21
(quick) HoneyBotDashboard Demo
-
8/9/2019 Dulaunoy Honeybot Introduction
16/21
-
8/9/2019 Dulaunoy Honeybot Introduction
17/21
-
8/9/2019 Dulaunoy Honeybot Introduction
18/21
Q&A
Thanks for listening
-
8/9/2019 Dulaunoy Honeybot Introduction
19/21
Backup Slides
-
8/9/2019 Dulaunoy Honeybot Introduction
20/21
IPv6 security
monitoringHoneypot/net in IPv6 is challenging especiallyregarding the space of allocated addresses. InHoneyBot, we designed various tricks to overcome
such limitation.
- Collecting Neighbor Discovery (RFC2461) messages toview current use of the network space
- Predicting manual IPv6 allocation (e.g. HammingDistance in IPv6 addresses)
-
8/9/2019 Dulaunoy Honeybot Introduction
21/21
Security of the
HoneyBot device- Low-interaction honeypot (limiting risks ofinteraction with potential attackers)
- Each HoneyBot device uniquely identified with X.509certificate- Solid-state disk (read-only filesystem), privilegeseparation and non-executable stack
