Honeypot Frameworks and Their Applications: A New Framework (eBook)

Chee Keong NG completed his Master of IT at Deakin University, Australia. He is now pursuing his PHD in Philosophy (IT). His research interests include honeypots, ransomware and deep learning. Dr Lei Pan received his Ph.D. in Computer Forensics from Deakin University, Melbourne, Australia, in 2008. He currently teaches at Deakin University, Burwood, Victoria, Australia, where he offers courses on cybersecurity. His research interests include cybersecurity and privacy, software security testing, and the applications of analytics in security and privacy. He is also an active cybersecurity educator on futurelearn.com. Professor Yang Xiang received his PhD in Computer Science from Deakin University, Australia and is currently the Dean of the Digital Research & Innovation Capability Platform at Swinburne University of Technology, Australia. His research interests include network and system security, data analytics, distributed systems, and networking. Further, he is a Senior Member of the IEEE.

Preface 7
Acknowledgements 8
Contents 9
1 Introduction to Honeypot 11
1.1 Introduction 11
References 13
2 Design Honeypots 16
2.1 The Concept of Honeypot (Basic Taxonomy) 16
2.2 Advanced Taxonomy of Honeypot 19
2.3 Roadmap of the Honeypot Concept 20
2.4 Challenges in Designing Honeypot 20
References 22
3 Specialized Honeypot Applications 23
3.1 Web-Server Based Honeypot 23
3.2 Web Client-Based Honeypot 26
3.3 Worm Detection Honeypot 29
3.4 Bot Detection Honeypot 33
3.5 Honeytoken 37
3.5.1 Anti-phishing Honeypot 37
3.5.2 Insider Detection Honeypot 40
3.6 Advanced Persistent Threat Honeypot 44
References 47
4 General Purposed Honeypot Applications 50
4.1 Dynamic Honeypot 50
4.2 Artificial Intelligent Honeypot 54
4.3 Shadow Honeypot 55
References 57
5 Other Honeypot Applications 58
5.1 Concealment of Honeypot 58
5.2 Application of Forensic in Honeypot 60
5.2.1 Honeypot Forensic for General Type Attack 62
5.2.2 Honeypot Forensics for Botnet 69
5.3 Direct Role of Honeypot in a Security System 71
References 72
6 Honeypot Framework, Limitation and Counter-Measure 74
6.1 Conceptual Framework 74
6.2 Common Features of Honeypot 76
6.3 Other Honeypot Detection Method 78
References 80
7 Ramsonware and Honeypot 82
7.1 Ransomware 82
7.2 Ransomware Honeypot 83
7.3 Bitcoin Honeytoken 84
References 84
8 Conclusions and Future Work 86
8.1 Conclusion 86
8.1.1 Summary 86
8.1.2 Future Research Work 88