Zaznavanje napadov z detekcijskim sistemom Honeypot : diplomsko delo visokošolskega strokovnega študija Informacijska varnost

Žužek, Jaka

| | SLO | ENG | Cookies and privacy

Bigger font | Smaller font

First page > Show document

Show document

Title:	Zaznavanje napadov z detekcijskim sistemom Honeypot : diplomsko delo visokošolskega strokovnega študija Informacijska varnost
Authors:	ID Žužek, Jaka (Author) ID Kežmah, Boštjan (Mentor) More about this mentor...
Files:	VS_Zuzek_Jaka_2015.pdf (748,80 KB) MD5: CB3DA659CF2591648F584E532F117812
Language:	Slovenian
Work type:	Bachelor thesis/paper
Typology:	2.11 - Undergraduate Thesis
Organization:	FVV - Faculty of Criminal Justice and Security
Abstract:	Število varnostnih incidentov, ki se zgodijo na spletu ali preko njega, vse bolj narašča. Napadalci, ki ogrožajo produkcijske sisteme, namreč z veliko vnemo odkrivajo vedno nove ranljivosti in nove načine za njihovo zlorabo in izkoriščanje. V želji, da bi spoznali več o vzorcih napadov in vedênju napadalcev, se je na področju varovanja informacijskih tehnologij razvil koncept elektronskih vab, imenovan honeypot. Na omrežje se ga postavi samo zato, da ga je mogoče napasti in ogroziti. Pri tem sistemske pravice napadalca oziroma avtomatiziranih skript v resnici niso takšne, kot se sprva zdi, preden tak vdiralec ugotovi, da se je znašel v pasti, pa lahko honeypot zabeleži vso njegovo neavtorizirano dejavnost v datoteke, do katerih pa napadalec nima dostopa. Koncept delovanja tovrstne tehnologije je zato izrednega pomena za zaznavanje in odkrivanje novih groženj, saj je za razliko od sistemov za zaznavanje in preprečevanje napadov in od požarnih zidov sposoben zaznavati tudi napredne trajne grožnje (APT). Tehnologija honeypot na varnostnem področju že zdaj veliko ponuja, še več pa obeta, vendar je splošni javnosti še neznana. Prav zato smo se odločili, da v okviru diplomske naloge raziščemo njeno delovanje in jo bolje spoznamo. V praksi smo to tehnologijo preizkusili s testiranjem honeypota Kippo SSH. Namen testiranja je bil uspešno vzpostaviti honeypot in ugotoviti, ali se napadi na produkcijske sisteme odvijajo dnevno. Poleg tega pa smo želeli preveriti tudi razlike med delovanjem honeypota v lokalnem omrežju in zunaj njega in skušali dokazati, da zabeleži honeypot zunaj lokalnega omrežja več napadov kot znotraj njega.
Keywords:	internet, napadi, grožnje, informacijska varnost, detekcijski sistemi, Honeypot, diplomske naloge
Place of publishing:	[Ljubljana
Place of performance:	[Ljubljana
Publisher:	J. Žužek]
Year of publishing:	2015
Year of performance:	2015
Number of pages:	44 str.
PID:	20.500.12556/DKUM-54425
UDC:	004.056(043.2)
COBISS.SI-ID:	3017706
NUK URN:	URN:SI:UM:DK:VQB3LBLH
Publication date in DKUM:	08.10.2015
Views:	1628
Downloads:	212
Metadata:
Categories:	FVV
:	Copy citation

Average score:	(0 votes)
Your score:	Voting is allowed only for logged in users.
Share:

Hover the mouse pointer over a document title to show the abstract or click on the title to get all document metadata.

Secondary language

Language:	English
Title:	Detecting Attacks with Honeypot System
Abstract:	The number of security breaches that happen on or through the internet, is growing. Attackers present a constant threat to production systems and they are vigorous and resourceful enough to always find new ways to compromise and exploit them. In the aim to learn more about attackers and attack patterns a new approach was proposed. The whole new concept was built around an idea which incorporated characteristics of a honeypot. It lures the attacker into a trap where it gives him tools to interact with in order to monitor his behaviour. Needless to say, the new technology goes by the same name. Honeypot. The only purpose of this kind of system is to be probed, attacked, compromised or exploited. In reality, attacker doesn't have priviliges to do whatever he wants on the compromised system as it first seems. Honeypot also stores all events in log files for later examination. Therefore, it is very usefull when we come to terms of detecting new threats. The thing that distinguish honeypot from other detection and prevention system or firewalls is the ability to detect new generation attacks, i.e. Advanced Persistant Threats (APT). The topic is relatively unknown to the general public. For that reason we have decided to do some research about honeypot technology. Furthermore, we also made some testings with Kippo SSH honeypot, so we can put what we learned from literature to practice. The purpose was to successfully deploy a honeypot and do some testings on internal and external network. We were curious if the attacks will happen on regular everyday basis. Also, we asked ourselves if the honeypot, which was deployed on the external network, directly to the internet, is going to log more attacks then the one deployed on the local area.
Keywords:	honeypot, detection systems, detecting attacks, network security, Kippo SSH

Comments

Leave comment

You must log in to leave a comment.

Comments (0)

0 - 0 / 0

There are no comments!

Back