Abstract:
Honeypot evangelists propagate the message that honeypots are particularly useful for learning from attackers. However, by looking at current honeypots, most of them are ...Show MoreMetadata
Abstract:
Honeypot evangelists propagate the message that honeypots are particularly useful for learning from attackers. However, by looking at current honeypots, most of them are statically configured and managed, which requires a priori knowledge about attackers. In this paper we propose a high-interaction honeypot capable of learning from attackers and capable of dynamically changing its behavior using a variant of reinforcement learning. It can strategically block the execution of programs, lure the attacker by substituting programs and insult attackers with the intent of revealing the attacker's nature and ethnic background. We also investigated the fact that attackers could learn to defeat the honeypot and discovered that attacker and honeypot interests sometimes diverge.
Published in: 12th IFIP/IEEE International Symposium on Integrated Network Management (IM 2011) and Workshops
Date of Conference: 23-27 May 2011
Date Added to IEEE Xplore: 18 August 2011
ISBN Information:
Print ISSN: 1573-0077