Real-Time Attack Monitoring on Telecom Network Using Open-Source Darknet and Honeypot Setup
DOI:
https://doi.org/10.13052/jicts2245-800X.524Keywords:
Darknet, Alerts, Cybersecurity, Honeypots, Cyber attacks, Network monitoring, Malware detectionAbstract
The traditional use of darknets is to passively monitor malicious traffic in a network. In this paper, we describe an experimental setup that leverages this property of the darknet in a network monitoring setup coupled with several honeypot servers. The honeypots are configured as a decoy to lure cyber attacks on the network. The cyber-security test-bed thus designed enables us to monitor an end-to-end mobile communication network test-bed [1] and detect attacks on the network in real-time. After successful trial runs, the results and alert incidents show that the cyber-security setup is efficient in detecting malicious activity in the network.
Downloads
References
George, K. J., Sivabalan, A., Prabhu, T., and Prasad, A. R. (2015).“End-to-End Mobile Communication Security Testbed Using Open Source Applications in Virtual Environment.” J. ICT Standardization, 3(1), 67–90.
Suzuki Mio and Inoue Daisuke, (2017). “DAEDALUS: Practical Alert System Based on Large-scale Darknet Monitoring for Protecting Live Networks”, Journal of the National Institute of Information and Communications Technology, 58.
Yegneswaran, V., Barford, P., and Plonka, D. (2004). “On the design and use of Internet sinks for network abuse monitoring”. In International Workshop on Recent Advances in Intrusion Detection, (pp. 146–165). Springer, Berlin, Heidelberg.
Moore, D., Voelker, G., and Savage, S. (2001). “Inferring Internet Denial of Service Activity”, In 10th USENIX Security Symposium, Washington D.C.
Moore, D., Shannon, C., Voelker, G. M., and Savage, S. (2004). “Network Telescopes: Technical Report”, Tech. rep., Cooperative Association for Internet Data Analysis (CAIDA), San Diego.
Campbell, R. M., Padayachee, K., and Masombuka, T. (2015). “A survey of honeypot research: Trends and opportunities”, In 10th International Conference for Internet Technology and Secured Transactions (ICITST).
Scarfone, K., and Mell, P. (2007). “Guide to Intrusion Detection and Prevention Systems (IDPS)” (PDF). Computer Security Resource Center. National Institute of Standards and Technology (800–94). Retrieved 1 January 2010.
Cooke, E., Bailey, M., Watson, D., Jahanian, F., and Nazario, J. (2004). The Internet motion sensor: A distributed global scoped Internet threat monitoring system. Technical Report CSE-TR-491-04, University of Michigan, Electrical Engineering and Computer Science.
Oberheide, J., Karir, M., and Mao, Z. M. (2007). Characterizing Dark DNS Behavior. In International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment (pp. 140–156). Springer, Berlin, Heidelberg.
Bailey, M., Cooke, E., Jahanian, F., Myrick, A., and Sinha, S. (2006). Practical darknet measurement. In Information Sciences and Systems, 40th Annual Conference (pp. 1496–1501). IEEE.
Snort. Available at: https://www.snort.org/
MySQL. Available at: https://www.mysql.com/
Song, D., Malan, R., and Stone, R. (2001). A snapshot of global Internet worm activity. Technical report, Arbor Networks.
Wang, Q., Chen, Z., and Chen, C. (2011). Darknet-based inference of internet worm temporal characteristics. IEEE Transactions on Information Forensics and Security, 6(4), 1382–1393.
Pang, R., Yegneswaran, V., Barford, P., Paxson, V., and Peterson, L. (2004). Characteristics of internet background radiation. In Procee-dings of the 4th ACM SIGCOMM conference on Internet measurement(pp. 27–40). ACM.
