Design of active HoneyPot system

초록

According to rapid growth of Internet infrastructure and information technology, anyone can get knowledge legally or illegally. Internet users can be classified as normal and abnormal user. Especially, abnormal users with hostility are getting more intelligent, so they can drain away the valuable information and use or destroy it illegally. The damage from abnormal user is also increasing, but research to detect abnormal users and to protect information is at still initial stage. The most security systems focus on how to detect and respond such an intrusion as quickly as possible of which they already have knowledge. In case of unknown intrusion, it is much harder to detect and respond it. In this paper, we implement a virtual emulation service that leads an intruder into HoneyPot, which monitors all behaviors in step by step. Building the new knowledge on the access paths and skills of intruder allows us to make a policy to protect a system from new attacks. Furthermore, we present an Active HoneyPot System, which combined with firewall and management server. In this system, firewall redirects an abnormal user to HoneyPot to learn advanced intruding skills and to respond more actively.